AsyncHttpClient async-http-client up to 2.15.x/3.0.10 HTTP Response sensitive cookie with improper samesite attribute

Summaryinfo

A vulnerability categorized as problematic has been discovered in AsyncHttpClient async-http-client up to 2.15.x/3.0.10. Affected by this issue is some unknown functionality of the component HTTP Response Handler. The manipulation results in sensitive cookie with improper samesite attribute. This vulnerability is cataloged as CVE-2026-55688. The attack may be launched remotely. There is no exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in AsyncHttpClient async-http-client up to 2.15.x/3.0.10. It has been classified as problematic. Affected is an unknown functionality of the component HTTP Response Handler. The manipulation with an unknown input leads to a sensitive cookie with improper samesite attribute vulnerability. CWE is classifying the issue as CWE-1275. The SameSite attribute for sensitive cookies is not set, or an insecure value is used. This is going to have an impact on integrity. CVE summarizes:

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. In versions from 2.0.0 prior to 2.16.0 and from 3.0.0.Beta1 prior to 3.0.11, ThreadSafeCookieStore stored a cookie under the value of its Domain attribute without verifying that the responding host is allowed to set a cookie for that domain, leading to a cookie tossing / cookie injection issue. A host the client connects to can therefore plant a cookie scoped to an unrelated domain, and the client will then send that cookie on later requests to that domain. Applications that use a single AsyncHttpClient instance - and thus the default, shared CookieStore - to reach both an attacker-influenced host and a trusted host are impacted. This issue has been fixed in versions 2.16.0 and 3.0.11.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-55688 since 06/17/2026. The exploitability is told to be difficult. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are neither technical details nor an exploit publicly available.

Upgrading to version 2.16.0 or 3.0.11 eliminates this vulnerability. Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• AsyncHttpClient

Name

• async-http-client

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6
• 2.7
• 2.8
• 2.9
• 2.10
• 2.11
• 2.12
• 2.13
• 2.14
• 2.15
• 3.0.0
• 3.0.1
• 3.0.2
• 3.0.3
• 3.0.4
• 3.0.5
• 3.0.6
• 3.0.7
• 3.0.8
• 3.0.9
• 3.0.10

Website

• Product: https://github.com/AsyncHttpClient/async-http-client/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion