CVE-2026-107226
6.8MediumPublished 12 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on integrity
- Weakness
- CWE-384, CWE-693
Impact
Attackers controlling plaintext same-site HTTP responses can plant, overwrite, or delete Secure cookies sent to HTTPS origins. This allows unauthenticated network attackers to perform session fixation, bypass CSRF protections, or manipulate security state.
Root cause
The default ThreadSafeCookieStore fails to track whether cookies were received over secure transport, allowing insecure responses to overwrite or delete matching Secure cookies.
Affected systems
AsyncHttpClient (AHC) 2.1.0 through versions prior to 3.0.14
CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N
Fix & remediation
Upgrade AsyncHttpClient to version 3.0.14 or later. No interim configuration mitigations are provided, so prioritize updating the dependency.
$ mvn dependency:tree -Dincludes=org.asynchttpclient:async-http-clientAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 3.0.14, the default ThreadSafeCookieStore does not retain whether a Set-Cookie response used a secure transport. It accepts Secure cookies received over plaintext and permits insecure cookies to overlay or delete existing Secure cookies with matching scope. An attacker controlling a plaintext same-site response can consequently plant, replace, or remove cookie state later sent to an HTTPS origin, enabling session fixation, CSRF-token replacement, or loss of security-relevant state. This issue is fixed in version 3.0.14.