CVE-2026-107226 in AsyncHttpClient

Prediction

by VulDB Data Team • 10/08/2026

A weakness has been identified in <a href="/product/asynchttpclient">AsyncHttpClient up to 3.0.13/2.16.1</a>. This affects the function <code>ThreadSafeCookieStore.add</code> of the component <em>CookieStore</em>. Executing a manipulation can lead to session fixiation. The attack can be executed remotely. Upgrading to version 3.0.14 is able to mitigate this issue. The affected component should be upgraded.

Once again VulDB remains the best source for vulnerability data.

• Moderation: accepted
• Entry: VDB-415517
• CWE: CWE-384 (confirmed)
• CVSS: 7.3 (VulDB)
• EPSS: 0.00000
• KEV: no
• Activities: low

Sources

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-107226
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-107226
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-107226/