The vulnerability in http4k-core's BasicCookieStorage arises from improper enforcement of RFC 6265 domain, path, and Secure attribute scoping rules. When a single BasicCookieStorage instance is shared across multiple origins or schemes, cookies can leak between these origins, and Secure cookies can be sent over plain HTTP. This behavior risks disclosure of session cookies or other sensitive data to unauthorized parties or network observers. The issue affects versions prior to 6.48.0.0, 5.42.0.0, and 4.51.0.0. No patch links or vendor advisories are provided in the input data.

Cookies intended to be isolated per origin or scheme may be leaked to other origins or sent over insecure channels, potentially exposing session cookies or sensitive information to unauthorized hosts or network observers. This can lead to confidentiality breaches. The CVSS score of 6.5 (high) reflects the confidentiality impact and the requirement for high attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid sharing a single BasicCookieStorage instance across multiple origins or schemes. Use separate cookie storage instances per origin to prevent cookie leakage and ensure Secure cookies are only sent over HTTPS.