Vulnerability · Published Oct 7, 2026 · Assigned by GitHub_M
CVE-2026-107280AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.uk
Medium 6.9
In plain English
A medium-severity security flaw in async-http-client from AsyncHttpClient. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, ThreadSafeCookieStore validates Domain attributes with domain matching but does not reject public suffixes. A host beneath a suffix such as co.uk can set a cookie for that suffix, after which the shared cookie store sends it to unrelated hosts under the suffix. This can inject or overwrite session-relevant cookie values across origins. This issue is fixed in versions 3.0.13 and 2.16.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | async-http-client | no fix listed | DEBIAN-CVE-2026-107280 |
| Maven | org.asynchttpclient:async-http-client | 3.0.13 | GHSA-f9m8-cv68-674w |
| Maven | org.asynchttpclient:async-http-client | 2.16.1 | GHSA-f9m8-cv68-674w |
| Ubuntu:22.04:LTS | async-http-client | no fix listed | UBUNTU-CVE-2026-107280 |
| Ubuntu:24.04:LTS | async-http-client | no fix listed | UBUNTU-CVE-2026-107280 |
| Ubuntu:26.04:LTS | async-http-client | no fix listed | UBUNTU-CVE-2026-107280 |
| Ubuntu:26.10 | async-http-client | no fix listed | UBUNTU-CVE-2026-107280 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| AsyncHttpClient | async-http-client | >= 3.0.0, < 3.0.13>= 2.0.0, < 2.16.1 |
Weakness: CWE-1275 · Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N
References
- https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-f9m8-cv68-674w x_refsource_CONFIRM
- https://github.com/AsyncHttpClient/async-http-client/commit/330267895fe0bdb41bbd027ea6b151d38ee7c23d x_refsource_MISC
- https://github.com/AsyncHttpClient/async-http-client/commit/d1f0ccec417092098d40242fee7dfac84bb3c21f x_refsource_MISC
- https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-2.16.1 x_refsource_MISC
- https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.13 x_refsource_MISC