Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-107226— AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPS

Quick assessment

Affected
AsyncHttpClient async-http-client
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

AsyncHttpClient（AHC）库允许 Java 应用轻松发起 HTTP 请求并异步处理 HTTP 响应。从版本 2.1.0 到 3.0.13，默认的 ThreadSafeCookieStore 在接收 Set-Cookie 响应时，未能记录该响应是否通过安全传输（如 HTTPS）送达。该实现允许接收通过明文传输（如 HTTP）发送的 Secure 标记的 Cookie，并允许非安全 Cookie 覆盖或删除具有相同作用域（scope）的已有 Secure Cookie。 因此，攻击者若能控制一个通过明文发

CVSS 6.8 · Medium EPSS 0.36% · P28

Possible ATT&CK Techniques 1 AI

T1557.002 · ARP Cache Poisoning

Affected Version Matrix 2

VendorProduct Version RangeStatus
AsyncHttpClient async-http-client >= 2.1.0, <= 2.16.1 affected
>= 3.0.0, < 3.0.14 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-107226

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPS
Source: CVE Program / CVE List V5
Vulnerability Description
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 3.0.14, the default ThreadSafeCookieStore does not retain whether a Set-Cookie response used a secure transport. It accepts Secure cookies received over plaintext and permits insecure cookies to overlay or delete existing Secure cookies with matching scope. An attacker controlling a plaintext same-site response can consequently plant, replace, or remove cookie state later sent to an HTTPS origin, enabling session fixation, CSRF-token replacement, or loss of security-relevant state. This issue is fixed in version 3.0.14.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
会话固定
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
AsyncHttpClient async-http-client >= 2.1.0, <= 2.16.1 -

II. Public POCs for CVE-2026-107226

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-107226

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-107226 (1)

Vendor Pages for CVE-2026-107226 (1)

IV. Related Vulnerabilities

Same product: async-http-client
Same vendor: AsyncHttpClient
Same weakness: CWE-384

V. Comments for CVE-2026-107226

No comments yet

Leave a comment