Log in Start free

Vulnerability · Published Oct 7, 2026 · Assigned by GitHub_M

CVE-2026-107229AsyncHttpClient: Incomplete origin checks in the default cookie store allow cookie tossing onto public-suffix and IP-address hosts

Medium 4.0

In plain English

A medium-severity session fixation in async-http-client from AsyncHttpClient. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).

Severity (CVSS 3.1)4.0Medium
Exploit odds (30 days)0.3%top 82.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.16.0 until 3.0.14, ThreadSafeCookieStore incompletely validates cookie Domain attributes. Missing private-section and default public-suffix rules, absent A-label normalization, locale-sensitive lowercasing, public-suffix host-only handling, and numeric or IP host checks allow one origin to store a cookie later sent to another origin. Applications sharing one client across trust domains can therefore receive attacker-injected cookies and may be exposed to session fixation. This issue is fixed in version 3.0.14.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12async-http-clientno fix listedDEBIAN-CVE-2026-107229
Ubuntu:22.04:LTSasync-http-clientno fix listedUBUNTU-CVE-2026-107229
Ubuntu:24.04:LTSasync-http-clientno fix listedUBUNTU-CVE-2026-107229
Ubuntu:26.04:LTSasync-http-clientno fix listedUBUNTU-CVE-2026-107229
Ubuntu:26.10async-http-clientno fix listedUBUNTU-CVE-2026-107229

Affected products (as reported)

VendorProductVersions
AsyncHttpClient async-http-client >= 3.0.11, < 3.0.14>= 2.16.0, <= 2.16.1

Weakness: CWE-384, CWE-1275 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N

References