CVE-2026-107280 in async-http-client
Summary
by MITRE • 10/08/2026
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, ThreadSafeCookieStore validates Domain attributes with domain matching but does not reject public suffixes. A host beneath a suffix such as co.uk can set a cookie for that suffix, after which the shared cookie store sends it to unrelated hosts under the suffix. This can inject or overwrite session-relevant cookie values across origins. This issue is fixed in versions 3.0.13 and 2.16.1.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/08/2026
The AsyncHttpClient library serves as a critical component for Java-based applications requiring efficient execution of HTTP requests and asynchronous processing of responses. Within this ecosystem, the ThreadSafeCookieStore class plays a pivotal role in managing cookie persistence across multiple threads to ensure stateful interactions with web servers are maintained correctly during concurrent operations. However, prior to versions 3.0.13 and 2.16.1, this component contained a significant logic flaw regarding how it validated domain attributes when storing cookies received from remote hosts. The vulnerability stems from an insufficient validation mechanism that relies solely on basic domain matching without considering the hierarchical structure of public suffixes managed by organizations such as Mozilla Foundation through the Public Suffix List.
The core technical flaw lies in the library's failure to reject or properly scope cookies associated with top-level domains and their immediate second-level counterparts, commonly referred to as public suffixes like co.uk, com.au, or org.cn. When a malicious server sets a cookie for a domain such as example.co.uk, the vulnerable implementation incorrectly treats this as valid for any host ending in .co.uk. Consequently, if another application running on a different thread accesses a completely unrelated site also under the .co.uk suffix, such as bank.example.co.uk or mail.service.co.uk, the ThreadSafeCookieStore erroneously attaches and sends the cookie originally intended for example.co.uk to these distinct origins. This behavior violates the fundamental Same-Origin Policy principles that browsers enforce, allowing cross-origin data leakage through HTTP headers in a server-side context where such isolation is typically assumed by application logic rather than enforced by a browser engine.
The operational impact of this vulnerability is severe, primarily centering on session hijacking and unauthorized access to sensitive user data. By injecting or overwriting session-relevant cookie values across unrelated origins, an attacker can potentially impersonate legitimate users on other services hosted within the same public suffix domain. For instance, if a victim authenticates with one service under .co.uk and receives a session token stored via AsyncHttpClient, that token could be inadvertently sent to another service under the same suffix during concurrent requests initiated by the application. This enables attackers to bypass authentication mechanisms, access restricted resources, or perform actions on behalf of the user without their knowledge. The risk is exacerbated in multi-tenant environments where different services share infrastructure but maintain distinct security boundaries based on domain separation.
This vulnerability aligns with CWE-16: Configuration and CWE-352: Cross-Site Request Forgery (CSRF) due to its reliance on improper state management, as well as CWE-942: Permissive Cross-domain Whitelist Acceptance because it fails to restrict data sharing based on strict domain boundaries. In the context of the MITRE ATT&CK framework, this flaw facilitates techniques related to Credential Access and Defense Evasion by allowing attackers to leverage valid session tokens across different application contexts within a shared suffix namespace. The lack of proper scoping effectively neutralizes the intended isolation between services that rely on distinct subdomains for security segmentation.
To mitigate this risk, organizations must upgrade AsyncHttpClient to version 3.0.13 or later, which includes patches ensuring that cookie domains are validated against public suffix lists before being stored in the shared cookie store. This update enforces stricter domain matching rules that prevent cookies set on one subdomain from leaking to other unrelated subdomains under the same parent suffix. Additionally, developers should audit their use of ThreadSafeCookieStore and consider implementing custom CookieSpec implementations if finer-grained control over cookie scoping is required for specific high-security applications. Regularly updating third-party libraries remains essential to maintaining robust security postures against evolving web application vulnerabilities that exploit state management inconsistencies.