Read the docs
TI-2026-69312 Aliases CVE-2026-107228GHSA-2jwh-9rmr-j4xf

AsyncHttpClient cookie store overrides a caller's Cookie header

Priority LOW 32CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-287.

Summary

The AsyncHttpClient async-http-client library for Java is affected from 2.1.0 through 2.16.1 and from 3.0.0 before 3.0.14. The enabled-by-default cookie store replaces a Cookie header that the caller set with setHeader or addHeader whenever the store holds a cookie for the same origin, which is an improper authentication flaw (CWE-287). In a shared client, cookies from one user can replace another user's request cookie, so the request runs under the wrong session. An attacker over the network with low privileges can exploit this under high attack complexity, and the flaw bypasses an earlier fix that covered only cookies supplied through addCookie.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 3.0.14, the enabled-by-default cookie store replaces a Cookie header explicitly supplied through setHeader or addHeader whenever the store contributes any cookie for the origin. In a shared client, stored cookies originating from one user can replace a different user's request cookie, causing the request to execute under the wrong session. This bypasses the earlier CVE-2024-53990 remediation, which covered cookies supplied through addCookie but not a directly supplied header. This issue is fixed in version 3.0.14.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00301 22nd percentileScored 2026-11-07
Fix Partial async-http-client (AsyncHttpClient): 3.0.14org.asynchttpclient:async-http-client (Maven): 3.0.14Red Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AsyncHttpClientasync-http-client3.0.0 to before 3.0.14; 2.1.0 – 2.16.13.0.14Patch availableCNA
—org.asynchttpclient:async-http-client (Maven)3.0.0 to before 3.0.143.0.14Patch availableGHSA-2jwh-9rmr-j4xf
—org.asynchttpclient:async-http-client (Maven)2.1.0 – 2.16.1—No fix listedGHSA-2jwh-9rmr-j4xf
  • async-http-client VendorAsyncHttpClient Affected 3.0.0 to before 3.0.14; 2.1.0 – 2.16.1 Fixed in 3.0.14 Patch available CNA
  • org.asynchttpclient:async-http-client (Maven) Vendor— Affected 3.0.0 to before 3.0.14 Fixed in 3.0.14 Patch available GHSA-2jwh-9rmr-j4xf
  • org.asynchttpclient:async-http-client (Maven) Vendor— Affected 2.1.0 – 2.16.1 Fixed in — No fix listed GHSA-2jwh-9rmr-j4xf

Remediation

Upgrade async-http-client 3.x to version 3.0.14, which fixes the issue. The sources list no fixed version for async-http-client 2.x. Red Hat rates the issue Moderate and lists Red Hat Fuse 7 as affected with no fix planned.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

  • Fix · CNA async-http-client (AsyncHttpClient) Fixed in 3.0.14
  • Fix · GHSA-2jwh-9rmr-j4xf org.asynchttpclient:async-http-client (Maven) Fixed in 3.0.14 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Fuse 7AffectedNo fix planned: Out of support scope

Timeline

  1. 2026-10-07 Threatist record created from CVE-2026-107228
  2. 2026-10-08 Alias added: GHSA-2jwh-9rmr-j4xf
  3. 2026-10-08 Fix available: Maven/org.asynchttpclient:[email protected] · GHSA-2jwh-9rmr-j4xf
  4. 2026-10-08 CVSS score added · GHSA-2jwh-9rmr-j4xf
  5. 2026-10-08 Weakness changed · GHSA-2jwh-9rmr-j4xf
  6. 2026-10-08 5 new references · GHSA-2jwh-9rmr-j4xf
  7. 2026-10-08 CISA SSVC decision points changed
  8. 2026-10-08 Priority changed: MEDIUM → LOW
  9. 2026-11-04 Affected versions changed · Red Hat
  10. 2026-11-04 CVSS score added · Red Hat

References

Advisory 1

Other 4

  • TI-2024-36149 AsyncHttpClient (AHC) library's `CookieStore` replaces explicitly defined `Cookie`s CVSS 4.0CRITICAL 9.2
  • TI-2026-69321 Cross-host replay in AsyncHttpClient leaks credentials to new host CVSS 4.0CRITICAL 9.4
  • TI-2026-69315 AsyncHttpClient sends passwords in cleartext after Digest downgrade CVSS 4.0HIGH 8.7
  • TI-2026-58825 AsyncHttpClient: Unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of service CVSS 3.1HIGH 7.5
  • TI-2026-69311 Unbounded WebSocket decompression in AsyncHttpClient enables DoS CVSS 3.1HIGH 7.5
  • TI-2026-58823 AsyncHttpClient: SOCKS proxy credentials sent to the origin server over plaintext HTTP CVSS 3.1HIGH 7.5
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences