VDB
CVE-2026-107280
CVE-2026-107280
PUBLISHED
CVSS 6.9 MEDIUM
Reported by GitHub_M · Published October 7, 2026
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, ThreadSafeCookieStore validates Domain attributes with domain matching but does not reject public suffixes. A host beneath a suffix such as co.uk can set a cookie for that suffix, after which the shared cookie store sends it to unrelated hosts under the suffix. This can inject or overwrite session-relevant cookie values across origins. This issue is fixed in versions 3.0.13 and 2.16.1.
Risk Scores
CVSS 4.0
6.9
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| AsyncHttpClient | async-http-client | >= 3.0.0, < 3.0.13, >= 2.0.0, < 2.16.1 |
| chainguard | pinot-fips | 0 |
| wolfi | druid | 0 |
| chainguard | pinot | 0 |
| chainguard | druid | 0 |
| AsyncHttpClient | async-http-client | 3.0.0, 2.0.0 |
| Maven | org.asynchttpclient:async-http-client | 2.0.0, 3.0.0 |
Timeline
- Oct 7, 2026 CVE Published
- Oct 8, 2026 EPSS Score
- Oct 8, 2026 Coalition ESS Score
- Oct 8, 2026 CVE Updated
- Oct 13, 2026 EPSS Score
- Oct 16, 2026 EPSS Score
- Oct 20, 2026 EPSS Score
- Oct 22, 2026 EPSS Score
- Oct 25, 2026 EPSS Score
- Oct 29, 2026 EPSS Score
- Oct 30, 2026 Security Advisory
References
- https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-f9m8-cv68-674w x_refsource_CONFIRM
- https://github.com/AsyncHttpClient/async-http-client/commit/330267895fe0bdb41bbd027ea6b151d38ee7c23d x_refsource_MISC
- https://github.com/AsyncHttpClient/async-http-client/commit/d1f0ccec417092098d40242fee7dfac84bb3c21f x_refsource_MISC
- https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-2.16.1 x_refsource_MISC
- https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.13 x_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2026-107280 advisory
- https://github.com/advisories/GHSA-f9m8-cv68-674w advisory