http4k-core versions before 6.48.0.0, 5.42.0.0, and 4.51.0.0 include a BasicCookieStorage implementation that does not properly enforce RFC 6265 cookie scoping rules. This flaw allows cookies intended for one origin or scheme to be sent to others, and Secure cookies may be transmitted over unencrypted HTTP connections. Clients using BasicCookieStorage for multiple origins or schemes are affected, while those using it for a single origin are not.