Insecure Cookie Management in AsyncHttpClient Library Affects Java Applications
CVE-2026-107226
What is CVE-2026-107226?
The AsyncHttpClient library, commonly used in Java applications for executing HTTP requests and processing responses asynchronously, suffers from an issue in the default ThreadSafeCookieStore. Between versions 2.1.0 and 3.0.14, the library fails to accurately retain whether a Set-Cookie response utilized secure transport. This flaw allows Secure cookies received over unsecure connections and enables insecure cookies to overwrite or delete existing Secure cookies within the same scope. An attacker controlling a plaintext same-site response can exploit this vulnerability to manipulate cookie states sent later to an HTTPS origin, thereby enabling risks such as session fixation and CSRF-token replacement. The issue has been resolved in version 3.0.14.
Affected Version(s)
async-http-client >= 2.1.0, <= 2.16.1 <= 2.1.0, 2.16.1
async-http-client >= 3.0.0, < 3.0.14 < 3.0.0, 3.0.14