When processing a Set-Cookie from a response, the CookieJar client middleware trusts the server-supplied Domain attribute verbatim, with no check that it domain-matches the host that sent the cookie (RFC6265 §5.3 step 6) and no public suffix check. A malicious or compromised server can therefore plant a cookie for any domain in the cookie jar, which is subsequently set on the client's next request to that victim domain, enabling session fixation or overwriting security-relevant cookies.
// impact
Session fixation and overwrite of security-relevant cookies for arbitrary domains contacted by the same wrapped client.
// preconditions
Application uses the CookieJar client middleware.
Application contacts an attacker-controlled (or compromised) server using the same jar it uses for trusted hosts.
// workarounds
Do not share a CookieJar across trusted and untrusted targets.
// note
This middleware still does not implement public suffix rejection.
// cvss v3.1 vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N
Attack vector
Network
Attack complexity
High
Privileges required
None
User interaction
None
Scope
Changed
Confidentiality
None
Integrity
High
Availability
None
Checked 2026-09-26 at 01:04 UTC. The most recent advisory here was published 2026-09-15. Updated continuously from NVD, GHSA, OSV and CNA feeds.