CVE-2026-107228: falha de média gravidade em AsyncHttpClient async-http-client
AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader (Bypass of CVE-2024-53990 Fix)
Publicada em
10Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.8
probabilidade de exploração
—
exploração observada
nãonenhuma fonte reporta
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 3.0.14, the enabled-by-default cookie store replaces a Cookie header explicitly supplied through setHeader or addHeader whenever the store contributes any cookie for the origin. In a shared client, stored cookies originating from one user can replace a different user's request cookie, causing the request to execute under the wrong session. This bypasses the earlier CVE-2024-53990 remediation, which covered cookies supplied through addCookie but not a directly supplied header. This issue is fixed in version 3.0.14.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Produtos afetados
AsyncHttpClient · async-http-clientCVEs relacionadas — AsyncHttpClient async-http-client
No mesmo produto, das mais perigosas para as menos.
CVE-2024-53990CRITICALAsyncHttpClient (AHC) library's `CookieStore` replaces explicitly defined `Cookie`sEPSS 0.6%CVE-2026-85721HIGHAsyncHttpClient: Unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of serviceEPSS 0.6%CVE-2026-85718MEDIUMAsyncHttpClient: Connection permit leak on TLS handshake failure causes per-host denial of serviceEPSS 0.5%CVE-2026-85717MEDIUMAsyncHttpClient: Client-wide realm credentials re-sent to a cross-origin redirect targetEPSS 0.5%CVE-2026-40490MEDIUMAsyncHttpClient leaks authorization credentials to untrusted domains on cross-origin redirectsEPSS 0.5%CVE-2026-45300HIGHasync-http-client: Cookie header not stripped on cross-origin redirectEPSS 0.5%
Referências
https://github.com/AsyncHttpClient/async-http-client/commit/fd9763620725126c1c8bb0af1ceb9a7523099a5fhttps://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.14https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-2jwh-9rmr-j4xf