Session Management Flaw in AsyncHttpClient Library by AsyncHttpClient
CVE-2026-107228
6.8MEDIUM
What is CVE-2026-107228?
The AsyncHttpClient library, utilized for executing HTTP requests within Java applications, possesses a vulnerability that allows cookies from one user session to overwrite another's request cookies. This occurs when cookies are stored and handled in a shared client environment between users. Consequently, a user's request may inadvertently execute under a different session, leading to unauthorized access or session hijacking. This issue bypasses previous remediation efforts, underscoring the need for developers to upgrade to version 3.0.14 or later to safeguard against this significant flaw.
Affected Version(s)
async-http-client >= 3.0.0, < 3.0.14 < 3.0.0, 3.0.14
async-http-client >= 2.1.0, <= 2.16.1 <= 2.1.0, 2.16.1