{"id":"GHSA-pr33-38xx-6r26","aliases":[],"url":"https://o3.security/vulnerability/GHSA-pr33-38xx-6r26","summary":"http4k: BasicCookieStorage` (renamed `InsecureCookieStorage`) did not enforce RFC 6265 cookie scoping; new `DefaultCookieStorage` is now the default","details":"### Impact\n\nThe previous `BasicCookieStorage` did not enforce RFC 6265 scoping rules around cookie domain, path, and `Secure` attribute. A client using a single storage instance to talk to multiple origins could have cookies leak across domains, or have `Secure` cookies sent over plain HTTP — the deprecation message states it bluntly: *\"BasicCookieStorage has no domain/path/scheme scoping and leaks cookies across origins. Use DefaultCookieStorage instead.\"*\n\n**Who is affected:** any client using `BasicCookieStorage` directly with cookies for more than one origin or scheme. Single-origin uses are unaffected.\n\n### Patches\n\n| Line | Fixed in | Edition |\n|------|----------|---------|\n| v6.x (Community) | **6.48.0.0** | Community |\n| v5.x (LTS) | **5.42.0.0** | Enterprise — contact [enterprise@http4k.org](mailto:enterprise@http4k.org) |\n| v4.x (LTS) | **4.51.0.0** | Enterprise — contact [enterprise@http4k.org](mailto:enterprise@http4k.org) |\n\nThe fix introduces `DefaultCookieStorage` (RFC 6265 compliant) as the drop-in default; `BasicCookieStorage` is renamed `InsecureCookieStorage` and remains available for callers with a deliberate need for the old behaviour.\n\n### Workarounds\n\nFor deployments that cannot upgrade immediately:\n- Use a dedicated `BasicCookieStorage` instance per origin / scheme, or\n- Switch to a separate RFC 6265-compliant cookie store implementation.\n\n### References\n\n- Fix release: [v6.48.0.0](https://github.com/http4k/http4k/releases/tag/6.48.0.0)\n- Cookie storage rewrite: [`6a9b44d743`](https://github.com/http4k/http4k/commit/6a9b44d743)\n- Background: [RFC 6265 — HTTP State Management Mechanism](https://datatracker.ietf.org/doc/html/rfc6265)","published":"2026-06-19T21:16:07Z","modified":"2026-06-19T21:30:08.882866622Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"org.http4k:http4k-core","fixedVersion":"6.48.0.0"},{"ecosystem":"Maven","name":"org.http4k:http4k-core","fixedVersion":"5.42.0.0"},{"ecosystem":"Maven","name":"org.http4k:http4k-core","fixedVersion":"4.51.0.0"}],"fix":{"url":"https://github.com/http4k/http4k/commit/6a9b44d743","label":"http4k/http4k@6a9b44d"},"references":[{"type":"WEB","url":"https://github.com/http4k/http4k/security/advisories/GHSA-pr33-38xx-6r26"},{"type":"WEB","url":"https://github.com/http4k/http4k/commit/6a9b44d743"},{"type":"WEB","url":"https://datatracker.ietf.org/doc/html/rfc6265"},{"type":"PACKAGE","url":"https://github.com/http4k/http4k"},{"type":"WEB","url":"https://github.com/http4k/http4k/releases/tag/6.48.0.0"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-06-19T21:30:08.882866622Z"}}