CVE-2026-107229 in async-http-client
Summary
by MITRE • 10/08/2026
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.16.0 until 3.0.14, ThreadSafeCookieStore incompletely validates cookie Domain attributes. Missing private-section and default public-suffix rules, absent A-label normalization, locale-sensitive lowercasing, public-suffix host-only handling, and numeric or IP host checks allow one origin to store a cookie later sent to another origin. Applications sharing one client across trust domains can therefore receive attacker-injected cookies and may be exposed to session fixation. This issue is fixed in version 3.0.14.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/08/2026
The AsyncHttpClient library serves as a critical component for Java-based applications requiring efficient execution of HTTP requests and asynchronous processing of responses. Within the versions spanning from 2.16.0 through 3.0.14, a significant security flaw exists in the ThreadSafeCookieStore implementation regarding the validation of cookie Domain attributes. This vulnerability stems from an incomplete adherence to RFC standards for domain matching, specifically failing to enforce private-section and default public-suffix rules. The absence of A-label normalization means that internationalized domain names are not correctly processed into their ASCII-compatible forms before comparison. Furthermore, the use of locale-sensitive lowercasing introduces inconsistencies in how hostnames are compared across different system locales, potentially allowing mismatches that should have been caught by strict case-insensitive matching.
The technical core of this vulnerability lies in the failure to implement public-suffix host-only handling and numeric or IP address checks. These omissions allow an attacker to craft cookies with Domain attributes that appear valid but effectively bypass standard origin boundaries. For instance, without proper public suffix list enforcement, a cookie set for a subdomain like blog.example.com might incorrectly be sent to the parent domain example.com if not handled correctly under host-only rules. Similarly, the lack of numeric or IP checks means that cookies intended for specific network addresses could be misapplied across different contexts. This incomplete validation logic creates a scenario where one origin can store a cookie that is subsequently transmitted to a completely different and unrelated origin during subsequent HTTP requests.
The operational impact of this flaw is severe, particularly in environments where applications share a single AsyncHttpClient instance across multiple trust domains or microservices. An attacker who controls an external service or injects malicious content into a page accessed by the application can set cookies with manipulated Domain attributes. When the shared client subsequently makes requests to other trusted internal services or APIs, it will automatically attach these attacker-injected cookies due to the flawed domain matching logic. This leads directly to session fixation attacks, where the victim's session identifier is controlled by an adversary, and cross-origin data leakage, as sensitive authentication tokens intended for one service are exposed to another unauthorized context.
This vulnerability aligns with CWE-613, which describes insufficient session expiration, but more accurately maps to CWE-200 or general information exposure through improper access control mechanisms inherent in flawed cookie handling logic. In the MITRE ATT&CK framework, this behavior facilitates Initial Access and Persistence techniques by allowing attackers to hijack valid user sessions without needing to steal credentials directly. The exploitation relies on the attacker's ability to influence the client-side state via injected cookies that are then blindly trusted by the server due to the shared session context propagated through the flawed library logic.
To mitigate this risk, organizations must upgrade the AsyncHttpClient library to version 3.0.14 or later, where these domain validation issues have been resolved. The fix ensures strict compliance with RFC standards for cookie domain matching, including proper handling of public suffixes, A-label normalization, and consistent case-insensitive comparisons regardless of locale settings. Additionally, developers should review their application architecture to avoid sharing HTTP clients across untrusted domains unless absolutely necessary, implementing separate client instances or explicit cookie filtering mechanisms as a defense-in-depth strategy. Regular dependency audits are essential to ensure that such library vulnerabilities do not persist in production environments.