MEDIUM 4.0 GitHub
CVE-2026-55688
AsyncHttpClient stores cookie for an unrelated domain (cookie tossing) via ThreadSafeCookieStore
### Impact
A **cookie tossing / cookie injection** issue (CWE-1275). `ThreadSafeCookieStore` stored a cookie under the value of its `Domain` attribute without verifying that the responding host is allowed to set a cookie for that domain (RFC 6265 §5.3 step 6). A host the client connects to can therefore plant a cookie scoped to an unrelated domain, and the client will then send that cookie on later requests to that domain.
### Who is Impacted
Applications that use a single `AsyncHttpClient` in
Affected Products
- maven/org.asynchttpclient:async-http-client >= 3.0.0.Beta1, < 3.0.11
- maven/org.asynchttpclient:async-http-client >= 2.0.0, < 2.16.0
References
- https://github.com/advisories/GHSA-m452-q8c9-rg2f
- https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-m452-q8c9-rg
- https://nvd.nist.gov/vuln/detail/CVE-2026-55688
- https://github.com/AsyncHttpClient/async-http-client/pull/2196
This medium severity vulnerability with a CVSS score of 4.0 was published on 2026-08-26 via GitHub. Affected: maven/org.asynchttpclient:async-http-client >= 3.0.0.Beta1, < 3.0.11, maven/org.asynchttpclient:async-http-client >= 2.0.0, < 2.16.0.
vulnfeed aggregates 11364 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.