CVE-2026-107226
Reported by github_m · Published October 12, 2026
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 3.0.14, the default ThreadSafeCookieStore does not retain whether a Set-Cookie response used a secure transport. It accepts Secure cookies received over plaintext and permits insecure cookies to overlay or delete existing Secure cookies with matching scope. An attacker controlling a plaintext same-site response can consequently plant, replace, or remove cookie state later sent to an HTTPS origin, enabling session fixation, CSRF-token replacement, or loss of security-relevant state. This issue is fixed in version 3.0.14.
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| AsyncHttpClient | async-http-client | >= 2.1.0, <= 2.16.1, >= 3.0.0, < 3.0.14 |
| AsyncHttpClient | async-http-client | 2.1.0, 3.0.0 |
| Maven | org.asynchttpclient:async-http-client | 3.0.0, 2.1.0 |
| chainguard | pinot | 0 |
| chainguard | druid | 0 |
| chainguard | pinot-fips | 0 |
| wolfi | druid | 0 |
Timeline
- Oct 8, 2026 CVE Published
- Oct 13, 2026 EPSS Score (8 in total, the first dated here)
- Oct 13, 2026 CVE Updated
- Oct 30, 2026 Security Advisory
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2026-107226
vulnetix vdb fixes CVE-2026-107226Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-107226/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-p2jm-6hj6-9rjg x_refsource_CONFIRM
- https://github.com/AsyncHttpClient/async-http-client/commit/6ec7ee45034d154f502852a962d2891746fb82c1 x_refsource_MISC
- https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.14 x_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2026-107226 advisory
- https://github.com/advisories/GHSA-p2jm-6hj6-9rjg advisory