CVE-2026-107280: AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.uk
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, ThreadSafeCookieStore validates Domain attributes with domain matching but does not reject public suffixes. A host beneath a suffix such as co.uk can set a cookie for that suffix, after which the shared cookie store sends it to unrelated hosts under the suffix. This can inject or overwrite session-relevant cookie values across origins. This issue is fixed in versions 3.0.13 and 2.16.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
AsyncHttpClient 3.xto a version that resolves this vulnerability.Fixed in 3.0.13 - Upgrade
Upgrade
AsyncHttpClient 2.xto a version that resolves this vulnerability.Fixed in 2.16.1
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Java applications using AsyncHttpClient with ThreadSafeCookieStore before version 3.0.13 or 2.16.1 are exposed if they use a shared cookie store while making requests to hosts beneath a public suffix.
What does an attacker need to exploit it?
An attacker needs control of, or the ability to cause the application to contact, a host under the same public suffix as another target host. That host can set a cookie scoped to the public suffix, which the shared store may then send to unrelated hosts beneath it.
What is the impact of a successful exploit?
A malicious host can inject or overwrite session-relevant cookie values for unrelated origins under the same public suffix. This can affect cookie-based session handling across those origins.
What should be done if upgrading is not immediately possible?
Avoid sharing a ThreadSafeCookieStore across requests to unrelated hosts under the same public suffix, and do not allow untrusted hosts to set cookies that will be retained for subsequent requests to other origins. Upgrade to AsyncHttpClient 3.0.13 or 2.16.1 when possible.