{"id":"CVE-2026-55688","aliases":["CLSA-2026-1791926769","CLSA-2026-1793887823","DEBIAN-CVE-2026-55688","EUVD-2026-41134","GHSA-m452-q8c9-rg2f","RHLW-2026-817b6809af7b9c1b","UBUNTU-CVE-2026-55688","USN-8655-1"],"status":"published","title":"AsyncHttpClient: Cookie stored for an unrelated domain (cookie tossing) via ThreadSafeCookieStore","description":"The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. In versions from 2.0.0 prior to 2.16.0 and from 3.0.0.Beta1 prior to 3.0.11, ThreadSafeCookieStore stored a cookie under the value of its Domain attribute without verifying that the responding host is allowed to set a cookie for that domain, leading to a cookie tossing / cookie injection issue. A host the client connects to can therefore plant a cookie scoped to an unrelated domain, and the client will then send that cookie on later requests to that domain. Applications that use a single AsyncHttpClient instance - and thus the default, shared CookieStore - to reach both an attacker-influenced host and a trusted host are impacted. This issue has been fixed in versions 2.16.0 and 3.0.11.","severity":{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.0033,"percentile":0.2649,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1275"],"published":"2026-07-01T19:40:12Z","modified":"2026-11-06T13:15:13Z","fixes":[{"ecosystem":"Maven","package":"org.asynchttpclient:async-http-client","fixed_in":["3.0.11","2.16.0"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"async-http-client","fixed_in":["2.12.3-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"async-http-client","fixed_in":["2.6.0-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"async-http-client","fixed_in":["2.12.3-1ubuntu0.22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"async-http-client","fixed_in":["2.12.3-1ubuntu0.24.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"async-http-client","fixed_in":["2.12.3-1ubuntu1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.asynchttpclient:async-http-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0.Beta1"},{"fixed":"3.0.11"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.asynchttpclient:async-http-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.16.0"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.asynchttpclient:async-http-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.1"},{"fixed":"2.12.1-tuxcare.1"}]}],"versions":["2.12.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.asynchttpclient:async-http-client-bom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.1"},{"fixed":"2.12.1-tuxcare.1"}]}],"versions":["2.12.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.asynchttpclient:async-http-client-example","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.1"},{"fixed":"2.12.1-tuxcare.1"}]}],"versions":["2.12.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.asynchttpclient:async-http-client-extras-guava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.1"},{"fixed":"2.12.1-tuxcare.1"}]}],"versions":["2.12.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.asynchttpclient:async-http-client-extras-jdeferred","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.1"},{"fixed":"2.12.1-tuxcare.1"}]}],"versions":["2.12.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.asynchttpclient:async-http-client-extras-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.1"},{"fixed":"2.12.1-tuxcare.1"}]}],"versions":["2.12.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.asynchttpclient:async-http-client-extras-registry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.1"},{"fixed":"2.12.1-tuxcare.1"}]}],"versions":["2.12.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.asynchttpclient:async-http-client-extras-retrofit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.1"},{"fixed":"2.12.1-tuxcare.1"}]}],"versions":["2.12.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.asynchttpclient:async-http-client-extras-rxjava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.1"},{"fixed":"2.12.1-tuxcare.1"}]}],"versions":["2.12.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.asynchttpclient:async-http-client-extras-rxjava2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.1"},{"fixed":"2.12.1-tuxcare.1"}]}],"versions":["2.12.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.asynchttpclient:async-http-client-extras-simple","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.1"},{"fixed":"2.12.1-tuxcare.1"}]}],"versions":["2.12.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.asynchttpclient:async-http-client-extras-typesafe-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.1"},{"fixed":"2.12.1-tuxcare.1"}]}],"versions":["2.12.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.asynchttpclient:async-http-client-netty-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.1"},{"fixed":"2.12.1-tuxcare.1"}]}],"versions":["2.12.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.asynchttpclient:async-http-client-project","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.1"},{"fixed":"2.12.1-tuxcare.1"}]}],"versions":["2.12.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.asynchttpclient:async-http-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.3"},{"fixed":"2.12.3-tuxcare.2"}]}],"versions":["2.12.3","2.12.3-tuxcare.1"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.asynchttpclient:async-http-client-bom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.3"},{"fixed":"2.12.3-tuxcare.2"}]}],"versions":["2.12.3","2.12.3-tuxcare.1"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.asynchttpclient:async-http-client-example","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.3"},{"fixed":"2.12.3-tuxcare.2"}]}],"versions":["2.12.3","2.12.3-tuxcare.1"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.asynchttpclient:async-http-client-extras-guava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.3"},{"fixed":"2.12.3-tuxcare.2"}]}],"versions":["2.12.3","2.12.3-tuxcare.1"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.asynchttpclient:async-http-client-extras-jdeferred","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.3"},{"fixed":"2.12.3-tuxcare.2"}]}],"versions":["2.12.3","2.12.3-tuxcare.1"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.asynchttpclient:async-http-client-extras-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.3"},{"fixed":"2.12.3-tuxcare.2"}]}],"versions":["2.12.3","2.12.3-tuxcare.1"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.asynchttpclient:async-http-client-extras-registry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.3"},{"fixed":"2.12.3-tuxcare.2"}]}],"versions":["2.12.3","2.12.3-tuxcare.1"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.asynchttpclient:async-http-client-extras-retrofit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.3"},{"fixed":"2.12.3-tuxcare.2"}]}],"versions":["2.12.3","2.12.3-tuxcare.1"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.asynchttpclient:async-http-client-extras-rxjava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.3"},{"fixed":"2.12.3-tuxcare.2"}]}],"versions":["2.12.3","2.12.3-tuxcare.1"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.asynchttpclient:async-http-client-extras-rxjava2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.3"},{"fixed":"2.12.3-tuxcare.2"}]}],"versions":["2.12.3","2.12.3-tuxcare.1"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.asynchttpclient:async-http-client-extras-simple","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.3"},{"fixed":"2.12.3-tuxcare.2"}]}],"versions":["2.12.3","2.12.3-tuxcare.1"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.asynchttpclient:async-http-client-extras-typesafe-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.3"},{"fixed":"2.12.3-tuxcare.2"}]}],"versions":["2.12.3","2.12.3-tuxcare.1"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.asynchttpclient:async-http-client-netty-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.3"},{"fixed":"2.12.3-tuxcare.2"}]}],"versions":["2.12.3","2.12.3-tuxcare.1"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.asynchttpclient:async-http-client-project","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.3"},{"fixed":"2.12.3-tuxcare.2"}]}],"versions":["2.12.3","2.12.3-tuxcare.1"],"bundled":15},{"source":"osv","ecosystem":"Debian:12","package":"async-http-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.3-1+deb12u1"}]}],"versions":["2.12.3-1"]},{"source":"osv","ecosystem":"Maven","package":"org.asynchttpclient:async-http-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0.Beta1"},{"fixed":"3.0.11"}]}],"versions":["3.0.0","3.0.0.Beta1","3.0.0.Beta2","3.0.0.Beta3","3.0.1","3.0.10","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9"]},{"source":"osv","ecosystem":"Maven","package":"org.asynchttpclient:async-http-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.16.0"}]}],"versions":["2.0.0","2.0.1","2.0.10","2.0.11","2.0.12","2.0.13","2.0.14","2.0.15","2.0.16","2.0.17","2.0.18","2.0.19","2.0.2","2.0.20","2.0.21","2.0.22","2.0.23","2.0.24","2.0.25","2.0.26","2.0.27","2.0.28","2.0.29","2.0.3","2.0.30","2.0.31","2.0.32","2.0.33","2.0.34","2.0.35","2.0.36","2.0.37","2.0.38","2.0.39","2.0.4","2.0.40","2.0.5","2.0.6","2.0.7","2.0.8","2.0.9","2.1.0","2.1.0-RC1","2.1.0-RC2","2.1.0-RC3","2.1.0-RC4","2.1.0-alpha1","2.1.0-alpha10","2.1.0-alpha11","2.1.0-alpha12","2.1.0-alpha13","2.1.0-alpha14","2.1.0-alpha15","2.1.0-alpha16","2.1.0-alpha17","2.1.0-alpha18","2.1.0-alpha19","2.1.0-alpha2","2.1.0-alpha20","2.1.0-alpha21","2.1.0-alpha22","2.1.0-alpha23","2.1.0-alpha24","2.1.0-alpha25","2.1.0-alpha26","2.1.0-alpha3","2.1.0-alpha4","2.1.0-alpha5","2.1.0-alpha6","2.1.0-alpha7","2.1.0-alpha8","2.1.0-alpha9","2.1.1","2.1.2","2.10.0","2.10.1","2.10.2","2.10.3","2.10.4","2.10.5","2.11.0","2.12.0","2.12.1","2.12.2","2.12.3","2.12.4","2.14.5","2.15.0","2.2.0","2.2.1","2.3.0","2.4.0","2.4.1","2.4.2","2.4.3","2.4.4","2.4.5","2.4.6","2.4.7","2.4.8","2.4.9","2.5.0","2.5.1","2.5.2","2.5.3","2.5.4","2.6.0","2.7.0","2.8.0","2.8.1","2.9.0"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.asynchttpclient:async-http-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.5.rhlw-00002"}]}],"versions":["2.0.0","2.0.0-RC1","2.0.0-RC10","2.0.0-RC11","2.0.0-RC12","2.0.0-RC13","2.0.0-RC14","2.0.0-RC15","2.0.0-RC16","2.0.0-RC17","2.0.0-RC18","2.0.0-RC19","2.0.0-RC2","2.0.0-RC20","2.0.0-RC21","2.0.0-RC3","2.0.0-RC4","2.0.0-RC5","2.0.0-RC6","2.0.0-RC7","2.0.0-RC8","2.0.0-RC9","2.0.0-alpha13","2.0.0-alpha14","2.0.0-alpha15","2.0.0-alpha16","2.0.0-alpha17","2.0.0-alpha18","2.0.0-alpha19","2.0.0-alpha20","2.0.0-alpha21","2.0.0-alpha22","2.0.0-alpha23","2.0.0-alpha24","2.0.0-alpha25","2.0.0-alpha26","2.0.0-alpha27","2.0.1","2.0.10","2.0.11","2.0.12","2.0.13","2.0.14","2.0.15","2.0.16","2.0.17","2.0.18","2.0.19","2.0.2","2.0.20","2.0.21","2.0.22","2.0.23","2.0.24","2.0.25","2.0.26","2.0.27","2.0.28","2.0.29","2.0.3","2.0.30","2.0.31","2.0.32","2.0.33","2.0.34","2.0.35","2.0.36","2.0.37","2.0.38","2.0.39","2.0.4","2.0.40","2.0.5","2.0.6","2.0.7","2.0.8","2.0.9","2.1.0","2.1.0-RC1","2.1.0-RC2","2.1.0-RC3","2.1.0-RC4","2.1.0-alpha1","2.1.0-alpha10","2.1.0-alpha11","2.1.0-alpha12","2.1.0-alpha13","2.1.0-alpha14","2.1.0-alpha15","2.1.0-alpha16","2.1.0-alpha17","2.1.0-alpha18","2.1.0-alpha19","2.1.0-alpha2","2.1.0-alpha20","2.1.0-alpha21","2.1.0-alpha22","2.1.0-alpha23","2.1.0-alpha24","2.1.0-alpha25","2.1.0-alpha26","2.1.0-alpha3","2.1.0-alpha4","2.1.0-alpha5","2.1.0-alpha6","2.1.0-alpha7","2.1.0-alpha8","2.1.0-alpha9","2.1.1","2.1.2","2.10.0","2.10.1","2.10.2","2.10.3","2.10.4","2.10.5","2.11.0","2.12.0","2.12.1","2.12.2","2.12.3","2.12.4","2.14.5","2.15.0","2.16.0","2.16.1","2.2.0","2.2.1","2.3.0","2.4.0","2.4.1","2.4.2","2.4.3","2.4.4","2.4.5","2.4.6","2.4.7","2.4.8","2.4.9","2.5.0","2.5.1","2.5.2","2.5.3","2.5.4","2.6.0","2.7.0","2.8.0","2.8.1","2.9.0","3.0.0","3.0.0.Beta1","3.0.0.Beta2","3.0.0.Beta3","3.0.1","3.0.2","3.0.3","3.0.4","3.0.5"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"async-http-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.5-1","1.6.5-2","1.6.5-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"async-http-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.5-4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"async-http-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.5-4","1.6.5-5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"async-http-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-1ubuntu0.1~esm1"}]}],"versions":["2.6.0-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"async-http-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.3-1ubuntu0.22.04.1"}]}],"versions":["2.12.2-1","2.12.3-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"async-http-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.3-1ubuntu0.24.04.1"}]}],"versions":["2.12.3-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"async-http-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.12.3-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"async-http-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.12.3-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"async-http-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.3-1ubuntu1.1"}]}],"versions":["2.12.3-1","2.12.3-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"async-http-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-1ubuntu0.1~esm1"}]}],"versions":["2.6.0-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"async-http-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.3-1ubuntu0.22.04.1"}]}],"versions":["2.12.2-1","2.12.3-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"async-http-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.3-1ubuntu0.24.04.1"}]}],"versions":["2.12.3-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"async-http-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.3-1ubuntu1.1"}]}],"versions":["2.12.3-1","2.12.3-1ubuntu1"]}],"products":[{"vendor":"asynchttpclient","product":"async-http-client"}],"references":[{"url":"https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-m452-q8c9-rg2f","tags":["x_refsource_CONFIRM","advisory","web","report"]},{"url":"https://github.com/AsyncHttpClient/async-http-client/pull/2196","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2026/08/msg00011.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55688","tags":["advisory"]},{"url":"https://github.com/AsyncHttpClient/async-http-client/pull/2199","tags":["web"]},{"url":"https://github.com/AsyncHttpClient/async-http-client/commit/8e4069cf3c92abe099db5fb13378ac2fe9e1fd3b","tags":["web"]},{"url":"https://github.com/AsyncHttpClient/async-http-client/commit/e6955c1e3951cf80e286981d064f6c926ce33f47","tags":["web"]},{"url":"https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-2.16.0","tags":["web"]},{"url":"https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.11","tags":["web"]},{"url":"https://github.com/advisories/GHSA-m452-q8c9-rg2f","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55688.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-55688","tags":["advisory"]},{"url":"https://github.com/AsyncHttpClient/async-http-client","tags":["package"]},{"url":"https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.10","tags":["web"]},{"url":"https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-fmxf-pm6p-7xgm","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45300.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45300","tags":["advisory"]},{"url":"https://github.com/AsyncHttpClient/async-http-client/commit/3b0e3e9e","tags":["fix"]},{"url":"https://github.com/advisories/GHSA-fmxf-pm6p-7xgm","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-55688","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-55688","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8655-1","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-55688","title":"AsyncHttpClient: Cookie stored for an unrelated domain (cookie tossing) via ThreadSafeCookieStore","description":"The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. In versions from 2.0.0 prior to 2.16.0 and from 3.0.0.Beta1 prior to 3.0.11, ThreadSafeCookieStore stored a cookie under the value of its Domain attribute without verifying that the responding host is allowed to set a cookie for that domain, leading to a cookie tossing / cookie injection issue. A host the client connects to can therefore plant a cookie scoped to an unrelated domain, and the client will then send that cookie on later requests to that domain. Applications that use a single AsyncHttpClient instance - and thus the default, shared CookieStore - to reach both an attacker-influenced host and a trusted host are impacted. This issue has been fixed in versions 2.16.0 and 3.0.11.","status":"published","published":"2026-07-01T19:40:12.004Z","modified":"2026-08-06T21:56:13.231Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-1275"],"updated_at":"2026-11-02T14:20:12.260247Z"}],"euvd":[{"id":"EUVD-2026-41134","description":"The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. In versions from 2.0.0 prior to 2.16.0 and from 3.0.0.Beta1 prior to 3.0.11, ThreadSafeCookieStore stored a cookie under the value of its Domain attribute without verifying that the responding host is allowed to set a cookie for that domain, leading to a cookie tossing / cookie injection issue. A host the client connects to can therefore plant a cookie scoped to an unrelated domain, and the client will then send that cookie on later requests to that domain. Applications that use a single AsyncHttpClient instance - and thus the default, shared CookieStore - to reach both an attacker-influenced host and a trusted host are impacted. This issue has been fixed in versions 2.16.0 and 3.0.11.","status":"published","published":"2026-07-01T19:40:12Z","modified":"2026-08-06T21:56:13Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:02:07.757838Z"}],"ghsa":[{"id":"GHSA-m452-q8c9-rg2f","title":"AsyncHttpClient stores cookie for an unrelated domain (cookie tossing) via ThreadSafeCookieStore","description":"### Impact\n A **cookie tossing / cookie injection** issue (CWE-1275). `ThreadSafeCookieStore` stored a cookie under the value of its `Domain` attribute without verifying that the responding host is allowed to set a cookie for that domain (RFC 6265 §5.3 step 6). A host the client connects to can therefore plant a cookie scoped to an unrelated domain, and the client will then send that cookie on later requests to that domain.\n\n### Who is Impacted\nApplications that use a single `AsyncHttpClient` instance - and thus the default, shared `CookieStore` - to reach **both** an attacker-influenced host and a trusted host. Typical exposure: crawlers, link-preview / webhook fetchers, SSRF-style \"fetch this URL\" features, multi-backend aggregators, or following redirects to an attacker-controlled host. The attacker can *write* a cookie the client presents to the victim host (session fixation, overwriting a session id / CSRF-token cookie); they cannot *read* the victim host's cookies. Applications that talk only to a fixed trusted backend, or that disable/scope the cookie store, are not exposed.\n\n### Patches\nFixed in 3.0.11 and 2.16.0\n\n### Workarounds\n- Disable the cookie store (setCookieStore(null)) when cookies are not needed; or\n- Use a separate AsyncHttpClient (separate cookie store) per trust domain so an attacker-influenced host and a trusted host never share a jar\n- Supply a custom CookieStore whose add(Uri, Cookie) rejects cookies whose Domain is not domain-matched by the request host.","status":"published","published":"2026-08-26T14:35:52Z","modified":"2026-08-26T14:35:53Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-1275"],"updated_at":"2026-11-02T14:41:07.031507Z"}],"nvd":[{"id":"CVE-2026-55688","description":"The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. In versions from 2.0.0 prior to 2.16.0 and from 3.0.0.Beta1 prior to 3.0.11, ThreadSafeCookieStore stored a cookie under the value of its Domain attribute without verifying that the responding host is allowed to set a cookie for that domain, leading to a cookie tossing / cookie injection issue. A host the client connects to can therefore plant a cookie scoped to an unrelated domain, and the client will then send that cookie on later requests to that domain. Applications that use a single AsyncHttpClient instance - and thus the default, shared CookieStore - to reach both an attacker-influenced host and a trusted host are impacted. This issue has been fixed in versions 2.16.0 and 3.0.11.","status":"published","published":"2026-07-01T20:17:11.273Z","modified":"2026-10-25T16:10:00.147Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-1275"],"updated_at":"2026-11-02T14:12:27.199837Z"}],"osv":[{"id":"CVE-2026-55688","title":"AsyncHttpClient: Cookie stored for an unrelated domain (cookie tossing) via ThreadSafeCookieStore","description":"The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. In versions from 2.0.0 prior to 2.16.0 and from 3.0.0.Beta1 prior to 3.0.11, ThreadSafeCookieStore stored a cookie under the value of its Domain attribute without verifying that the responding host is allowed to set a cookie for that domain, leading to a cookie tossing / cookie injection issue. A host the client connects to can therefore plant a cookie scoped to an unrelated domain, and the client will then send that cookie on later requests to that domain. Applications that use a single AsyncHttpClient instance - and thus the default, shared CookieStore - to reach both an attacker-influenced host and a trusted host are impacted. This issue has been fixed in versions 2.16.0 and 3.0.11.","status":"published","published":"2026-07-01T19:40:12.004Z","modified":"2026-10-28T11:15:00.890254119Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-1275"],"updated_at":"2026-11-02T15:45:11.22012Z"},{"id":"DEBIAN-CVE-2026-55688","description":"The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. In versions from 2.0.0 prior to 2.16.0 and from 3.0.0.Beta1 prior to 3.0.11, ThreadSafeCookieStore stored a cookie under the value of its Domain attribute without verifying that the responding host is allowed to set a cookie for that domain, leading to a cookie tossing / cookie injection issue. A host the client connects to can therefore plant a cookie scoped to an unrelated domain, and the client will then send that cookie on later requests to that domain. Applications that use a single AsyncHttpClient instance - and thus the default, shared CookieStore - to reach both an attacker-influenced host and a trusted host are impacted. This issue has been fixed in versions 2.16.0 and 3.0.11.","status":"published","published":"2026-07-01T20:17:11.273Z","modified":"2026-10-26T11:47:34.571333461Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:57.590991Z"},{"id":"GHSA-m452-q8c9-rg2f","title":"AsyncHttpClient stores cookie for an unrelated domain (cookie tossing) via ThreadSafeCookieStore","description":"### Impact\n A **cookie tossing / cookie injection** issue (CWE-1275). `ThreadSafeCookieStore` stored a cookie under the value of its `Domain` attribute without verifying that the responding host is allowed to set a cookie for that domain (RFC 6265 §5.3 step 6). A host the client connects to can therefore plant a cookie scoped to an unrelated domain, and the client will then send that cookie on later requests to that domain.\n\n### Who is Impacted\nApplications that use a single `AsyncHttpClient` instance - and thus the default, shared `CookieStore` - to reach **both** an attacker-influenced host and a trusted host. Typical exposure: crawlers, link-preview / webhook fetchers, SSRF-style \"fetch this URL\" features, multi-backend aggregators, or following redirects to an attacker-controlled host. The attacker can *write* a cookie the client presents to the victim host (session fixation, overwriting a session id / CSRF-token cookie); they cannot *read* the victim host's cookies. Applications that talk only to a fixed trusted backend, or that disable/scope the cookie store, are not exposed.\n\n### Patches\nFixed in 3.0.11 and 2.16.0\n\n### Workarounds\n- Disable the cookie store (setCookieStore(null)) when cookies are not needed; or\n- Use a separate AsyncHttpClient (separate cookie store) per trust domain so an attacker-influenced host and a trusted host never share a jar\n- Supply a custom CookieStore whose add(Uri, Cookie) rejects cookies whose Domain is not domain-matched by the request host.","status":"published","published":"2026-08-26T14:35:52Z","modified":"2026-09-10T03:51:14.308963751Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-1275"],"updated_at":"2026-11-02T15:46:51.10002Z"},{"id":"RHLW-2026-817b6809af7b9c1b","title":"Lightwell Security Advisory: async-http-client 3.0.5.rhlw-00002","description":"Red Hat Lightwell has released org.asynchttpclient:async-http-client 3.0.5.rhlw-00002 with backported fixes for CVE-2026-45300 and CVE-2026-55688.\n\nCVE-2026-45300: async-http-client: Cookie header not stripped on cross-origin redirect\n\nCVE-2026-55688: AsyncHttpClient: Cookie stored for an unrelated domain (cookie tossing) via ThreadSafeCookieStore\n\nThis patched artifact is a drop-in replacement for org.asynchttpclient:async-http-client 3.0.5 from Maven Central.","status":"published","published":"2026-09-29T15:37:07Z","modified":"2026-10-27T04:00:12.24249274Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"UBUNTU-CVE-2026-55688","description":"The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. In versions from 2.0.0 prior to 2.16.0 and from 3.0.0.Beta1 prior to 3.0.11, ThreadSafeCookieStore stored a cookie under the value of its Domain attribute without verifying that the responding host is allowed to set a cookie for that domain, leading to a cookie tossing / cookie injection issue. A host the client connects to can therefore plant a cookie scoped to an unrelated domain, and the client will then send that cookie on later requests to that domain. Applications that use a single AsyncHttpClient instance - and thus the default, shared CookieStore - to reach both an attacker-influenced host and a trusted host are impacted. This issue has been fixed in versions 2.16.0 and 3.0.11.","status":"published","published":"2026-07-01T20:17:00Z","modified":"2026-10-17T12:59:08.951425633Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:56:41.382716Z"},{"id":"CLSA-2026-1791926769","title":"TuxCare security update for org.asynchttpclient (13 CVEs)","description":"TuxCare rebuilt 14 org.asynchttpclient packages to address 13 CVEs. Fixed in 2.12.1-tuxcare.1.","status":"published","published":"2026-10-13T21:26:09Z","modified":"2026-10-15T09:47:45.855594885Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1793887823","title":"TuxCare security update for org.asynchttpclient (16 CVEs)","description":"TuxCare rebuilt 14 org.asynchttpclient packages to address 16 CVEs. Fixed in 2.12.3-tuxcare.2.","status":"published","published":"2026-11-05T15:10:25Z","modified":"2026-11-06T13:15:13.773820413Z","updated_at":"2026-11-06T13:44:09.891978Z"},{"id":"USN-8655-1","title":"async-http-client vulnerability","description":"It was discovered that AsyncHttpClient did not properly verify that the\nresponding host was allowed to set cookies for a given domain in its\nThreadSafeCookieStore. An attacker could use this to plant cookies scoped to\nunrelated domains, which would then be sent on later requests to those\ndomains.","status":"published","published":"2026-08-20T17:57:45Z","modified":"2026-08-26T22:58:00.26628839Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}