{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-100725", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-09-26T02:40:56.226Z", "datePublished": "2026-09-27T01:28:31.397Z", "dateUpdated": "2026-10-29T21:15:26.791Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-29T21:15:26.791Z"}, "datePublic": "2026-06-16T00:00:00.000Z", "title": "http4k before 6.48.0.0 Cookie Scoping Bypass via BasicCookieStorage", "descriptions": [{"lang": "en", "value": "http4k (Maven artifact org.http4k:http4k-core) before 6.48.0.0, 5.42.0.0, and 4.51.0.0 ships a BasicCookieStorage (client-side cookie store used by ClientFilters.Cookies) that does not enforce RFC 6265 scoping rules for the cookie domain, path, and Secure attributes. When a single BasicCookieStorage instance is used to talk to more than one origin or scheme, cookies stored for one origin can be sent to other origins, and cookies marked Secure can be sent over plain HTTP, potentially disclosing session cookies or other sensitive values to unauthorized hosts or network observers. Clients that use a storage instance for a single origin are not affected."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Exposure of Sensitive Information to an Unauthorized Actor", "cweId": "CWE-200", "type": "CWE"}]}], "affected": [{"vendor": "http4k", "product": "http4k", "defaultStatus": "unaffected", "packageURL": "pkg:maven/org.http4k/http4k-core", "versions": [{"version": "6.0.0.0", "status": "affected", "versionType": "custom", "lessThan": "6.48.0.0"}, {"version": "6.48.0.0", "status": "unaffected", "versionType": "custom"}]}, {"vendor": "http4k", "product": "http4k", "defaultStatus": "unaffected", "packageURL": "pkg:maven/org.http4k/http4k-core", "versions": [{"version": "5.0.0.0", "status": "affected", "versionType": "custom", "lessThan": "5.42.0.0"}, {"version": "5.42.0.0", "status": "unaffected", "versionType": "custom"}]}, {"vendor": "http4k", "product": "http4k", "defaultStatus": "unaffected", "packageURL": "pkg:maven/org.http4k/http4k-core", "versions": [{"version": "0", "status": "affected", "versionType": "custom", "lessThan": "4.51.0.0"}, {"version": "4.51.0.0", "status": "unaffected", "versionType": "custom"}]}], "metrics": [{"cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.3, "baseSeverity": "HIGH", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS"}, {"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM"}, "format": "CVSS"}], "references": [{"url": "https://github.com/http4k/http4k/security/advisories/GHSA-pr33-38xx-6r26", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-pr33-38xx-6r26)"}, {"url": "https://github.com/http4k/http4k/commit/6a9b44d743", "tags": ["patch"], "name": "Patch Commit"}, {"name": "VulnCheck Advisory: http4k before 6.48.0.0 Cookie Scoping Bypass via BasicCookieStorage", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/http4k-before-6.48.0.0-cookie-scoping-bypass-via-basiccookiestorage"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-28T16:47:23.806596Z", "id": "CVE-2026-100725", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-28T16:48:28.688Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-100725", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-28T16:47:23.806596Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-28T16:48:05.653Z"}}], "cna": {"title": "http4k before 6.48.0.0 Cookie Scoping Bypass via BasicCookieStorage", "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "http4k", "product": "http4k", "versions": [{"status": "affected", "version": "6.0.0.0", "lessThan": "6.48.0.0", "versionType": "custom"}, {"status": "unaffected", "version": "6.48.0.0", "versionType": "custom"}], "packageURL": "pkg:maven/org.http4k/http4k-core", "defaultStatus": "unaffected"}, {"vendor": "http4k", "product": "http4k", "versions": [{"status": "affected", "version": "5.0.0.0", "lessThan": "5.42.0.0", "versionType": "custom"}, {"status": "unaffected", "version": "5.42.0.0", "versionType": "custom"}], "packageURL": "pkg:maven/org.http4k/http4k-core", "defaultStatus": "unaffected"}, {"vendor": "http4k", "product": "http4k", "versions": [{"status": "affected", "version": "0", "lessThan": "4.51.0.0", "versionType": "custom"}, {"status": "unaffected", "version": "4.51.0.0", "versionType": "custom"}], "packageURL": "pkg:maven/org.http4k/http4k-core", "defaultStatus": "unaffected"}], "datePublic": "2026-06-16T00:00:00.000Z", "references": [{"url": "https://github.com/http4k/http4k/security/advisories/GHSA-pr33-38xx-6r26", "name": "GitHub Security Advisory (GHSA-pr33-38xx-6r26)", "tags": ["vendor-advisory"]}, {"url": "https://github.com/http4k/http4k/commit/6a9b44d743", "name": "Patch Commit", "tags": ["patch"]}, {"url": "https://www.vulncheck.com/advisories/http4k-before-6.48.0.0-cookie-scoping-bypass-via-basiccookiestorage", "name": "VulnCheck Advisory: http4k before 6.48.0.0 Cookie Scoping Bypass via BasicCookieStorage", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "http4k (Maven artifact org.http4k:http4k-core) before 6.48.0.0, 5.42.0.0, and 4.51.0.0 ships a BasicCookieStorage (client-side cookie store used by ClientFilters.Cookies) that does not enforce RFC 6265 scoping rules for the cookie domain, path, and Secure attributes. When a single BasicCookieStorage instance is used to talk to more than one origin or scheme, cookies stored for one origin can be sent to other origins, and cookies marked Secure can be sent over plain HTTP, potentially disclosing session cookies or other sensitive values to unauthorized hosts or network observers. Clients that use a storage instance for a single origin are not affected."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "Exposure of Sensitive Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-29T21:15:26.791Z"}}}, "cveMetadata": {"cveId": "CVE-2026-100725", "state": "PUBLISHED", "dateUpdated": "2026-10-29T21:15:26.791Z", "dateReserved": "2026-09-26T02:40:56.226Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-09-27T01:28:31.397Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:maven/org.http4k/http4k-core", "product": "http4k", "vendor": "http4k", "versions": [{"lessThan": "6.48.0.0", "status": "affected", "version": "6.0.0.0", "versionType": "custom"}, {"status": "unaffected", "version": "6.48.0.0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "packageURL": "pkg:maven/org.http4k/http4k-core", "product": "http4k", "vendor": "http4k", "versions": [{"lessThan": "5.42.0.0", "status": "affected", "version": "5.0.0.0", "versionType": "custom"}, {"status": "unaffected", "version": "5.42.0.0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "packageURL": "pkg:maven/org.http4k/http4k-core", "product": "http4k", "vendor": "http4k", "versions": [{"lessThan": "4.51.0.0", "status": "affected", "version": "0", "versionType": "custom"}, {"status": "unaffected", "version": "4.51.0.0", "versionType": "custom"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "http4k (Maven artifact org.http4k:http4k-core) before 6.48.0.0, 5.42.0.0, and 4.51.0.0 ships a BasicCookieStorage (client-side cookie store used by ClientFilters.Cookies) that does not enforce RFC 6265 scoping rules for the cookie domain, path, and Secure attributes. When a single BasicCookieStorage instance is used to talk to more than one origin or scheme, cookies stored for one origin can be sent to other origins, and cookies marked Secure can be sent over plain HTTP, potentially disclosing session cookies or other sensitive values to unauthorized hosts or network observers. Clients that use a storage instance for a single origin are not affected."}], "id": "CVE-2026-100725", "lastModified": "2026-10-29T21:17:06.990", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 4.2, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.3, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-100725", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-28T16:47:23.806596Z", "version": "2.0.3"}}]}, "published": "2026-09-27T02:17:20.760", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/http4k/http4k/commit/6a9b44d743"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/http4k/http4k/security/advisories/GHSA-pr33-38xx-6r26"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/http4k-before-6.48.0.0-cookie-scoping-bypass-via-basiccookiestorage"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "org.http4k/http4k-core: http4k-core: Sensitive information disclosure via improper cookie scoping", "id": "2542022", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2542022"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N", "status": "draft"}, "cwe": "CWE-201", "details": ["http4k (Maven artifact org.http4k:http4k-core) before 6.48.0.0, 5.42.0.0, and 4.51.0.0 ships a BasicCookieStorage (client-side cookie store used by ClientFilters.Cookies) that does not enforce RFC 6265 scoping rules for the cookie domain, path, and Secure attributes. When a single BasicCookieStorage instance is used to talk to more than one origin or scheme, cookies stored for one origin can be sent to other origins, and cookies marked Secure can be sent over plain HTTP, potentially disclosing session cookies or other sensitive values to unauthorized hosts or network observers. Clients that use a storage instance for a single origin are not affected.", "A flaw was found in http4k-core. The client-side cookie storage mechanism fails to enforce standard scoping rules for domain, path, and secure transmission attributes. When an application communicates with multiple destinations using a single cookie store, cookies intended for one server can be mistakenly sent to other servers, or cookies designated for secure connections can be sent over unencrypted connections. An unauthorized host or network observer could exploit this behavior to intercept sensitive session tokens and authentication credentials."], "mitigation": {"lang": "en:us", "value": "Upgrade to http4k-core 4.51.0.0, 5.42.0.0, 6.48.0.0, or later on the corresponding release branch. If upgrading is not possible, do not share BasicCookieStorage across origins or HTTP/HTTPS schemes; use separate storage per origin."}, "name": "CVE-2026-100725", "package_state": [{"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Out of support scope", "package_name": "http4k-core", "product_name": "Red Hat Fuse 7"}], "public_date": "2026-09-27T01:28:31Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-100725\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-100725\nhttps://github.com/http4k/http4k/commit/6a9b44d743\nhttps://github.com/http4k/http4k/security/advisories/GHSA-pr33-38xx-6r26\nhttps://www.vulncheck.com/advisories/http4k-before-6.48.0.0-cookie-scoping-bypass-via-basiccookiestorage"], "statement": "http4k-core versions before 4.51.0.0, 5.42.0.0, and 6.48.0.0 do not enforce cookie domain, path, and Secure scoping. Applications sharing cookie storage across origins or schemes may disclose session tokens or credentials; single-origin storage is unaffected.", "threat_severity": "Moderate"}