{"id":"GHSA-pr33-38xx-6r26","title":"http4k: BasicCookieStorage` (renamed `InsecureCookieStorage`) did not enforce RFC 6265 cookie scoping; new `DefaultCookieStorage` is now the default","summary":"http4k: BasicCookieStorage` (renamed `InsecureCookieStorage`) did not enforce RFC 6265 cookie scoping; new `DefaultCookieStorage` is now the default","severity":"medium","cwe":["CWE-200"],"vendor":"http4k","product":"org.http4k:http4k-core","ecosystem":"maven","affected":["org.http4k:http4k-core >= 6.0.0.0, < 6.48.0.0","org.http4k:http4k-core >= 5.0.0.0, < 5.42.0.0","org.http4k:http4k-core < 4.51.0.0"],"patched":["org.http4k:http4k-core 6.48.0.0","org.http4k:http4k-core 5.42.0.0","org.http4k:http4k-core 4.51.0.0"],"published":"2026-06-19","updated":"2026-06-19","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-pr33-38xx-6r26","references":[{"url":"https://github.com/http4k/http4k/security/advisories/GHSA-pr33-38xx-6r26"},{"url":"https://github.com/http4k/http4k/commit/6a9b44d743"},{"url":"https://datatracker.ietf.org/doc/html/rfc6265"},{"url":"https://github.com/http4k/http4k/releases/tag/6.48.0.0"},{"url":"https://github.com/advisories/GHSA-pr33-38xx-6r26"}],"tags":["ghsa","maven"],"ingestedAt":"2026-06-22T13:35:24.322Z","slug":"GHSA-pr33-38xx-6r26","body":"## Overview\n\n### Impact\n\nThe previous `BasicCookieStorage` did not enforce RFC 6265 scoping rules around cookie domain, path, and `Secure` attribute. A client using a single storage instance to talk to multiple origins could have cookies leak across domains, or have `Secure` cookies sent over plain HTTP — the deprecation message states it bluntly: *\"BasicCookieStorage has no domain/path/scheme scoping and leaks cookies across origins. Use DefaultCookieStorage instead.\"*\n\n**Who is affected:** any client using `BasicCookieStorage` directly with cookies for more than one origin or scheme. Single-origin uses are unaffected.\n\n### Patches\n\n| Line | Fixed in | Edition |\n|------|----------|---------|\n| v6.x (Community) | **6.48.0.0** | Community |\n| v5.x (LTS) | **5.42.0.0** | Enterprise — contact [enterprise@http4k.org](mailto:enterprise@http4k.org) |\n| v4.x (LTS) | **4.51.0.0** | Enterprise — contact [enterprise@http4k.org](mailto:enterprise@http4k.org) |\n\nThe fix introduces `DefaultCookieStorage` (RFC 6265 compliant) as the drop-in default; `BasicCookieStorage` is renamed `InsecureCookieStorage` and remains available for callers with a deliberate need for the old behaviour.\n\n### Workarounds\n\nFor deployments that cannot upgrade immediately:\n- Use a dedicated `BasicCookieStorage` instance per origin / scheme, or\n- Switch to a separate RFC 6265-compliant cookie store implementation.\n\n### References\n\n- Fix release: [v6.48.0.0](https://github.com/http4k/http4k/releases/tag/6.48.0.0)\n- Cookie storage rewrite: [`6a9b44d743`](https://github.com/http4k/http4k/commit/6a9b44d743)\n- Background: [RFC 6265 — HTTP State Management Mechanism](https://datatracker.ietf.org/doc/html/rfc6265)\n\n## Affected packages\n\n- `org.http4k:http4k-core >= 6.0.0.0, < 6.48.0.0`\n- `org.http4k:http4k-core >= 5.0.0.0, < 5.42.0.0`\n- `org.http4k:http4k-core < 4.51.0.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `org.http4k:http4k-core 6.48.0.0`\n- `org.http4k:http4k-core 5.42.0.0`\n- `org.http4k:http4k-core 4.51.0.0`","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}