Riskcovery

CVE-2026-107229

AsyncHttpClient: Incomplete origin checks in the default cookie store allow cookie tossing onto public-suffix and IP-address hosts

State
Published
Severity
4.0 Medium
Published
Oct 7, 2026
Updated
Oct 8, 2026
Reserved
Oct 7, 2026

Read the record on cve.org

Description

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.16.0 until 3.0.14, ThreadSafeCookieStore incompletely validates cookie Domain attributes. Missing private-section and default public-suffix rules, absent A-label normalization, locale-sensitive lowercasing, public-suffix host-only handling, and numeric or IP host checks allow one origin to store a cookie later sent to another origin. Applications sharing one client across trust domains can therefore receive attacker-injected cookies and may be exposed to session fixation. This issue is fixed in version 3.0.14.

Scores

CVSSScoreVectorSource
3.14.0 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:NGitHub_M

Weaknesses

  • CWE-384 Session Fixation
  • CWE-1275 Sensitive Cookie with Improper SameSite Attribute

Affected Products

ProductVersions
async-http-clientAsyncHttpClient
  • >= 3.0.11, < 3.0.14Affected
  • >= 2.16.0, <= 2.16.1Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.