Medium severity · published Oct 7, 2026
CVE-2026-107229
AsyncHttpClient: Incomplete origin checks in the default cookie store allow cookie tossing onto public-suffix and IP-address hosts
4.0
CVSS
0.3%
EPSS
No
On KEV
Description
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.16.0 until 3.0.14, ThreadSafeCookieStore incompletely validates cookie Domain attributes. Missing private-section and default public-suffix rules, absent A-label normalization, locale-sensitive lowercasing, public-suffix host-only handling, and numeric or IP host checks allow one origin to store a cookie later sent to another origin. Applications sharing one client across trust domains can therefore receive attacker-injected cookies and may be exposed to session fixation. This issue is fixed in version 3.0.14.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 18% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AS
async-http-client · AsyncHttpClient
>= 3.0.11, < 3.0.14; >= 2.16.0, <= 2.16.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-107229
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-107229
x_refsource_CONFIRM
https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-qjr7-w8pj-pmv9
x_refsource_MISC
https://github.com/AsyncHttpClient/async-http-client/commit/7dc5bbc2d0a48aa2a9caf089a626dcfd333168e9
x_refsource_MISC
https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.14
More from async-http-client
9.4
CVE-2026-107282
AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host
8.8
CVE-2026-107279
AsyncHttpClient: Digest mutual authentication is switched off by a peer offering qop=auth-int
8.7
CVE-2026-107231
AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext
7.6
CVE-2026-107281
AsyncHttpClient: Connection pool key omits the authenticated principal, so an NTLM or Negotiate connection is reused across identities
7.5
CVE-2026-107232
AsyncHttpClient: Origin credentials sent in cleartext to a proxy that rejects the CONNECT