Log in Start free

Vulnerability · Published Dec 2, 2024 · Assigned by GitHub_M

CVE-2024-53990AsyncHttpClient (AHC) library's `CookieStore` replaces explicitly defined `Cookie`s

Critical 9.2

In plain English

A critical-severity improper authentication in async-http-client from AsyncHttpClient. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)9.2Critical
Exploit odds (30 days)0.7%top 45.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. When making any HTTP request, the automatically enabled and self-managed CookieStore (aka cookie jar) will silently replace explicitly defined Cookies with any that have the same name from the cookie jar. For services that operate with multiple users, this can result in one user's Cookie being used for another user's requests.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12async-http-clientno fix listedDEBIAN-CVE-2024-53990
Mavenorg.asynchttpclient:async-http-client2.12.4GHSA-mfj5-cf8g-g2fv
Mavenorg.asynchttpclient:async-http-client3.0.1GHSA-mfj5-cf8g-g2fv
Ubuntu:22.04:LTSasync-http-clientno fix listedUBUNTU-CVE-2024-53990
Ubuntu:24.04:LTSasync-http-clientno fix listedUBUNTU-CVE-2024-53990
Ubuntu:25.10async-http-clientno fix listedUBUNTU-CVE-2024-53990
Ubuntu:26.04:LTSasync-http-clientno fix listedUBUNTU-CVE-2024-53990
Ubuntu:26.10async-http-clientno fix listedUBUNTU-CVE-2024-53990

Affected products (as reported)

VendorProductVersions
AsyncHttpClient async-http-client < 3.0.1

Weakness: CWE-287 · Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References