CVE-2026-107229 | BDVDB-2026-384375 Detail

Description#

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.16.0 until 3.0.14, ThreadSafeCookieStore incompletely validates cookie Domain attributes. Missing private-section and default public-suffix rules, absent A-label normalization, locale-sensitive lowercasing, public-suffix host-only handling, and numeric or IP host checks allow one origin to store a cookie later sent to another origin. Applications sharing one client across trust domains can therefore receive attacker-injected cookies and may be exposed to session fixation. This issue is fixed in version 3.0.14.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-10-07Record published in the CVE List.
2. Version 22026-10-08Most recent update recorded in the CVE List.