Technical impact
The vulnerable http4k BasicCookieStorage does not enforce RFC 6265 scoping rules for domain, path, and Secure attributes. When a single storage instance is used to interact with multiple origins or schemes, cookies set for one origin can be transmitted to others, and cookies marked Secure can be sent over plain HTTP. This flaw can leak session identifiers or other sensitive data to unauthorized hosts or eavesdroppers. The weakness is a classic information disclosure (CWE‑200) and improper access control (CWE‑201).
Affected Systems
This issue affects all versions of the http4k core library released before 6.48.0.0, 5.42.0.0, and 4.51.0.0. Upgrade to any newer version to receive the patch.
Risk and Exploitability
Based on the description, it is inferred that the attack vector is client‑side: an application that incorporates the affected http4k library and mistakenly reuses a single BasicCookieStorage instance across multiple domains or schemes. An attacker who controls the application code can redirect cookies or observe network traffic to capture credentials. The CVSS score of 8.3 indicates high severity. While the EPSS score is 0.00239 (0.24%), the vulnerability is not listed in CISA KEV, suggesting no known active exploit campaigns. Mitigation is straightforward but requires proper library usage; the risk is highest when the library is used in cross‑origin contexts.
