VDB
CVE-2026-107226
CVE-2026-107226
PUBLISHED
CVSS 6.8 MEDIUM
Reported by GitHub_M · Published October 12, 2026
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 3.0.14, the default ThreadSafeCookieStore does not retain whether a Set-Cookie response used a secure transport. It accepts Secure cookies received over plaintext and permits insecure cookies to overlay or delete existing Secure cookies with matching scope. An attacker controlling a plaintext same-site response can consequently plant, replace, or remove cookie state later sent to an HTTPS origin, enabling session fixation, CSRF-token replacement, or loss of security-relevant state. This issue is fixed in version 3.0.14.
Risk Scores
CVSS 3.1
6.8
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| AsyncHttpClient | async-http-client | >= 2.1.0, <= 2.16.1, >= 3.0.0, < 3.0.14 |
| AsyncHttpClient | async-http-client | 2.1.0, 3.0.0 |
| Maven | org.asynchttpclient:async-http-client | 3.0.0, 2.1.0 |
| chainguard | pinot | 0 |
| chainguard | druid | 0 |
| chainguard | pinot-fips | 0 |
| wolfi | druid | 0 |
Timeline
- Oct 8, 2026 CVE Published
- Oct 13, 2026 EPSS Score
- Oct 13, 2026 CVE Updated
- Oct 14, 2026 EPSS Score
- Oct 16, 2026 EPSS Score
- Oct 20, 2026 EPSS Score
- Oct 21, 2026 EPSS Score
- Oct 23, 2026 EPSS Score
- Oct 25, 2026 EPSS Score
- Oct 29, 2026 EPSS Score
- Oct 30, 2026 Security Advisory
References
- https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-p2jm-6hj6-9rjg x_refsource_CONFIRM
- https://github.com/AsyncHttpClient/async-http-client/commit/6ec7ee45034d154f502852a962d2891746fb82c1 x_refsource_MISC
- https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.14 x_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2026-107226 advisory
- https://github.com/advisories/GHSA-p2jm-6hj6-9rjg advisory