Vulnerability · Published Oct 7, 2026 · Assigned by GitHub_M

CVE-2026-107228AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader (Bypass of CVE-2024-53990 Fix)

Medium 6.8

In plain English

A medium-severity improper authentication in async-http-client from AsyncHttpClient. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.8Medium

Exploit odds (30 days)0.3%top 77.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 3.0.14, the enabled-by-default cookie store replaces a Cookie header explicitly supplied through setHeader or addHeader whenever the store contributes any cookie for the origin. In a shared client, stored cookies originating from one user can replace a different user's request cookie, causing the request to execute under the wrong session. This bypasses the earlier CVE-2024-53990 remediation, which covered cookies supplied through addCookie but not a directly supplied header. This issue is fixed in version 3.0.14.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	async-http-client	no fix listed	DEBIAN-CVE-2026-107228
Maven	org.asynchttpclient:async-http-client	3.0.14	GHSA-2jwh-9rmr-j4xf
Maven	org.asynchttpclient:async-http-client	no fix listed	GHSA-2jwh-9rmr-j4xf
Ubuntu:22.04:LTS	async-http-client	no fix listed	UBUNTU-CVE-2026-107228
Ubuntu:24.04:LTS	async-http-client	no fix listed	UBUNTU-CVE-2026-107228
Ubuntu:26.04:LTS	async-http-client	no fix listed	UBUNTU-CVE-2026-107228
Ubuntu:26.10	async-http-client	no fix listed	UBUNTU-CVE-2026-107228

Affected products (as reported)

Vendor	Product	Versions
AsyncHttpClient	async-http-client	>= 3.0.0, < 3.0.14>= 2.1.0, <= 2.16.1

Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

References

https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-2jwh-9rmr-j4xf x_refsource_CONFIRM
https://github.com/AsyncHttpClient/async-http-client/commit/fd9763620725126c1c8bb0af1ceb9a7523099a5f x_refsource_MISC
https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.14 x_refsource_MISC