MEDIUM 6.8 GitHub
CVE-2026-107226
AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPS
### Impact
The cookie store ignores the scheme a `Set-Cookie` arrived on. draft-ietf-httpbis-rfc6265bis-22 (approved to obsolete RFC 6265, in the RFC Editor queue) Section 5.7 requires a user agent to ignore a cookie with the `Secure` attribute unless it arrived over a secure connection (step 13), and to ignore a non-Secure cookie from an insecure connection when it would overlay a Secure cookie the store already holds (step 16). Neither rule is implemented. The only `Secure` handling is on retr
Affected Products
- maven/org.asynchttpclient:async-http-client >= 3.0.0, <= 3.0.13
- maven/org.asynchttpclient:async-http-client >= 2.1.0, <= 2.16.1
References
- https://github.com/advisories/GHSA-p2jm-6hj6-9rjg
- https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-p2jm-6hj6-9r
- https://github.com/AsyncHttpClient/async-http-client/commit/6ec7ee45034d154f502852a962d289
- https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-projec
This medium severity vulnerability with a CVSS score of 6.8 was published on 2026-10-08 via GitHub. Affected: maven/org.asynchttpclient:async-http-client >= 3.0.0, <= 3.0.13, maven/org.asynchttpclient:async-http-client >= 2.1.0, <= 2.16.1.
vulnfeed aggregates 13827 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.