p PatchFirst

CVE-2026-107229

CVE-2026-107229 · AsyncHttpClient: Incomplete origin checks in the default cookie store allow cookie tossing onto public-suffix and IP-address hosts

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.16.0 until 3.0.14, ThreadSafeCookieStore incompletely validates cookie Domain attributes. Missing private-section and default public-suffix rules, absent A-label normalization, locale-sensitive lowercasing, public-suffix host-only handling, and numeric or IP host checks allow one origin to store a cookie later sent to another origin. Applications sharing one client across trust domains can therefore receive attacker-injected cookies and may be exposed to session fixation. This issue is fixed in version 3.0.14.

CVSS 4.0 · Medium · EPSS 0.3%

Published
Updated

Stack: system

Affected products and versions

  • async-http-client

    Versions
    • >= 3.0.11, < 3.0.14: Affected
    • >= 2.16.0, <= 2.16.1: Affected

    No fix published

  • async-http-client Debian:12

    Versions
    • 2.12.3-1
    • 2.12.3-1+deb12u1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • async-http-client Ubuntu:Pro:14.04:LTS

    Versions
    • 1.6.5-1
    • 1.6.5-2
    • 1.6.5-2ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • async-http-client Ubuntu:16.04:LTS

    Versions
    • 1.6.5-4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • async-http-client Ubuntu:18.04:LTS

    Versions
    • 1.6.5-4
    • 1.6.5-5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • async-http-client Ubuntu:Pro:20.04:LTS

    Versions
    • 2.6.0-1
    • 2.6.0-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • async-http-client Ubuntu:22.04:LTS

    Versions
    • 2.12.2-1
    • 2.12.3-1
    • 2.12.3-1ubuntu0.22.04.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • async-http-client Ubuntu:24.04:LTS

    Versions
    • 2.12.3-1
    • 2.12.3-1ubuntu0.24.04.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • async-http-client Ubuntu:26.10

    Versions
    • 2.12.3-1ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • async-http-client Ubuntu:26.04:LTS

    Versions
    • 2.12.3-1
    • 2.12.3-1ubuntu1
    • 2.12.3-1ubuntu1.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →