Skip to content
Log inStart free trial

GHSA-m452-q8c9-rg2f CVE-2026-55688

AsyncHttpClient stores cookie for an unrelated domain (cookie tossing) via ThreadSafeCookieStore

Medium Maven
Severity
4.0 / 10
Medium · CVSS 3.1
Exploit chance (EPSS)
0.33%
Chance of exploitation in the next 30 days. Higher than 26.20% of scored vulnerabilities.
Known exploited
No
Not in CISA's catalog
Weakness
CWE-1275 Sensitive Cookie with Improper SameSite Attribute
Fix
3.0.11
Upgrade org.asynchttpclient:async-http-client to this version or later

Description

Impact

A cookie tossing / cookie injection issue (CWE-1275). ThreadSafeCookieStore stored a cookie under the value of its Domain attribute without verifying that the responding host is allowed to set a cookie for that domain (RFC 6265 §5.3 step 6). A host the client connects to can therefore plant a cookie scoped to an unrelated domain, and the client will then send that cookie on later requests to that domain.

Who is Impacted

Applications that use a single AsyncHttpClient instance - and thus the default, shared CookieStore - to reach both an attacker-influenced host and a trusted host. Typical exposure: crawlers, link-preview / webhook fetchers, SSRF-style "fetch this URL" features, multi-backend aggregators, or following redirects to an attacker-controlled host. The attacker can write a cookie the client presents to the victim host (session fixation, overwriting a session id / CSRF-token cookie); they cannot read the victim host's cookies. Applications that talk only to a fixed trusted backend, or that disable/scope the cookie store, are not exposed.

Patches

Fixed in 3.0.11 and 2.16.0

Workarounds

  • Disable the cookie store (setCookieStore(null)) when cookies are not needed; or
  • Use a separate AsyncHttpClient (separate cookie store) per trust domain so an attacker-influenced host and a trusted host never share a jar
  • Supply a custom CookieStore whose add(Uri, Cookie) rejects cookies whose Domain is not domain-matched by the request host.

Affected versions

Maven

PackageVulnerableFixed in
org.asynchttpclient:async-http-client
>= 3.0.0.Beta1, < 3.0.11
3.0.11
org.asynchttpclient:async-http-client
>= 2.0.0, < 2.16.0
2.16.0

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

org.asynchttpclient:async-http-client Maven → 3.0.11

maven
<dependency><groupId>org.asynchttpclient</groupId><artifactId>async-http-client</artifactId><version>3.0.11</version></dependency>
gradle
implementation("org.asynchttpclient:async-http-client:3.0.11")

Severity breakdown

CVSS 3.1 4.0

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N

Attack vector
Network
Attack complexity
High
Privileges required
None
User interaction
None
Scope
Changed
Confidentiality
None
Integrity
Low
Availability
None

Weakness

CWE-1275: Sensitive Cookie with Improper SameSite Attribute

The SameSite attribute for sensitive cookies is not set, or an insecure value is used.

How to prevent it
  • Implementation: Set the SameSite attribute of a sensitive cookie to 'Lax' or 'Strict'. This instructs the browser to apply this cookie only to same-domain requests, which provides a good Defense in Depth against CSRF attacks. When the 'Lax' value is in use, cookies are also sent for top-level cross-domain navigation via HTTP GET, HEAD, OPTIONS, and TRACE methods, but not for other HTTP methods that are more like to cause side-effects of state mutation.

References

Advisories

Packages

Other links

Timeline

  1. Published
  2. Last updated by the source
  3. Latest EPSS score
AdvisorySeverityWhy it's related
GHSA-p2jm-6hj6-9rjg
AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPS
Medium Also affects org.asynchttpclient:async-http-client
GHSA-3wp9-xfwm-rjjf
AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel
Medium Also affects org.asynchttpclient:async-http-client
GHSA-mfj3-87qq-382v
AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random source
Low Also affects org.asynchttpclient:async-http-client
GHSA-jmqq-x5g9-9p2w
AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host
Critical Also affects org.asynchttpclient:async-http-client
GHSA-f9m8-cv68-674w
AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.uk
Medium Also affects org.asynchttpclient:async-http-client
GHSA-rqf5-2wxv-rjf4
AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext
High Also affects org.asynchttpclient:async-http-client
GHSA-v2j5-22fr-j62r
AsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy logins
High Also affects org.asynchttpclient:async-http-client
GHSA-2jwh-9rmr-j4xf
AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader (Bypass of CVE-2024-53990 Fix)
Medium Also affects org.asynchttpclient:async-http-client
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor