cyfenced.com →

[ CVE-2026-107226 · Published 12 Oct 2026 ]

AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPS

CVSS 6.8 EPSS <1%Fix available

[ Description ]Official description

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 3.0.14, the default ThreadSafeCookieStore does not retain whether a Set-Cookie response used a secure transport. It accepts Secure cookies received over plaintext and permits insecure cookies to overlay or delete existing Secure cookies with matching scope. An attacker controlling a plaintext same-site response can consequently plant, replace, or remove cookie state later sent to an HTTPS origin, enabling session fixation, CSRF-token replacement, or loss of security-relevant state. This issue is fixed in version 3.0.14.

[ Fixes ]Fixes and patches

[ Packages ]Affected open-source packages

  • org.asynchttpclient:async-http-client mavenAffected >= 3.0.0, <= 3.0.13 · fixed in 3.0.14 · GHSA-p2jm-6hj6-9rjg
  • org.asynchttpclient:async-http-client mavenAffected >= 2.1.0, <= 2.16.1 · GHSA-p2jm-6hj6-9rjg

[ References ]References