CVE-2026-107226 · GHSA-p2jm-6hj6-9rjg

AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPS

Risk score: 51/100
CVSS: 6.8 v3.1
Exploit chance (30 days): 0.4%
Published: 8 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 3.0.14, the default ThreadSafeCookieStore does not retain whether a Set-Cookie response used a secure transport. It accepts Secure cookies received over plaintext and p…
Affected: org.asynchttpclient:async-http-client (maven) >= 3.0.0, <= 3.0.13; org.asynchttpclient:async-http-client (maven) >= 2.1.0, <= 2.16.1
Fix: Upgrade org.asynchttpclient:async-http-client to 3.0.14 or later.
Exploitation: No known exploitation

Why it is Yellow

CVSS 6.8 medium
On your watchlist: Maven

Affected packages

Package	Ecosystem	Vulnerable	Fixed in
org.asynchttpclient:async-http-client	maven	>= 3.0.0, <= 3.0.13	3.0.14
org.asynchttpclient:async-http-client	maven	>= 2.1.0, <= 2.16.1	No fix yet

References

Original description

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 3.0.14, the default ThreadSafeCookieStore does not retain whether a Set-Cookie response used a secure transport. It accepts Secure cookies received over plaintext and permits insecure cookies to overlay or delete existing Secure cookies with matching scope. An attacker controlling a plaintext same-site response can consequently plant, replace, or remove cookie state later sent to an HTTPS origin, enabling session fixation, CSRF-token replacement, or loss of security-relevant state. This issue is fixed in version 3.0.14.

Last activity 8 Oct 2026. Patch Forecast updates every hour.