The vulnerability lies in the Http4s library’s handling of Set‑Cookie headers. Prior to versions 0.23.35 and 1.0.0‑M47, the render method emits cookie names, values, domain, path, and extensions without neutralizing semicolons or control characters. This allows an attacker who can influence any of these fields to inject additional cookie attributes such as Domain, Path, or SameSite, broaden the cookie’s scope or weaken security policies, and to inject control characters that can cause HTTP header splitting on permissive backends. Together these issues support HTTP response splitting and cookie injection, identified as CWE‑113 and CWE‑1286.

The affected product is the Http4s Scala HTTP library. Versions prior to 0.23.35 and 1.0.0‑M47 are vulnerable. Any application that uses those versions of Http4s for rendering Set‑Cookie headers is exposed.

The CVSS score is 4.8, indicating moderate severity. EPSS is not available, so the likelihood of exploitation is uncertain, but the vulnerability is not listed in CISA's KEV catalog. The usual attack path requires an application developer or an attacker that can supply unvalidated data to the ResponseCookie construction. If the input originates from an external source, the attacker could craft values that manipulate cookie attributes or split headers, potentially leading to session hijacking or privilege escalation in the browser. No remote code execution is directly possible, and a successful exploitation depends on the ability to influence cookie fields within the server code.