Function validate_options() in http.lua currently rejects cookies with unrecognized attributes. Per RFC 6265, Section 5.2 such attributes should be ignored:

6. Process the attribute-name and attribute-value according to the requirements in the following subsections. (Notice that attributes with unrecognized attribute-names are ignored.)

The current behavior has real-world impact. As an example, Digi devices set cookies with attribute version:

Set-Cookie: SID=c98fefa3ad659caa20b89582419bb14f; Max-Age=1200; Version=1

The following trivial patch remediates the issue:

--- a/nselib/http.lua
+++ b/nselib/http.lua
@@ -302,7 +302,8 @@
               end
             elseif not (cookie_key == 'httponly' or cookie_key == 'secure') then
               stdnse.debug1("http: Unknown field in cookie table: %s", cookie_key)
-              bad = true
+              -- Ignore unrecognized attributes (per RFC 6265, Section 5.2)
+              -- bad = true
             end
           end
         end

Please let me know if you have any questions or concerns. Otherwise I will commit the patch in a few weeks.