AsyncHttpClient Cookie Source Check Bypass (CVE-2026-107229) Advisory

Vulnerability Overview Title: Incomplete origin checks in default cookie storage allow cookie injection to public suffixes and IP address hosts Description: Impact: accepts a header whose attribute names a host not owned by the responding server, because the added origin check did not cover this scenario. In this case, the cookie is stored under a key that later matches requests to a different host, meaning a response from one host contributes a cookie to requests of another host. Specific Impact Scenarios: 1. Domain: The private portion of the public suffix list. 2. Domain: Equals the request host, where the host itself is a public suffix. 3. Numeric Domain: Requests to IP addresses. 4. Domain: Top-level domain lists are treated only as wildcards. 5. Internationalized Suffixes: Entries in the list are Unicode, but the attribute is stored only as an A-label. 6. Turkish or Azerbaijani Default Locales: The request host and attribute are lowercased according to the JVM's default locale prior to the check. CVE ID: CVE-2026-107229 Affected Versions Affected Versions: - 3.x: 3.0.11 to 3.0.13 - 2.x: 2.16.0 to 2.16.1 Affected Applications: Applications using an instance with a single cookie store (the default) that can reach multiple origins, where one origin is attacker-controlled. Mitigation Fixed Version: 3.0.14 Fix Details: - Bundles the complete public suffix list, including the private portion; applies the default rule from the list; matches internationalized rules via their A-label and case-insensitively against ; retains a cookie whose equals a public suffix request host as host-only; and handles a cookie whose host has a right label that is an IP prefix or IP address, ensuring domain matching is consistent across storage and retrieval paths. Default Rule Changes: Single-label names such as or are now treated as public suffixes. Therefore, can no longer be used with shared cookies such as . Cookies not matching these conditions are unaffected. References Related CVEs: CVE-2026-107229, CVE-2026-107230, CVE-2026-107231, CVE-2026-107232, CVE-2026-107233, CVE-2026-107234, CVE-2026-107235, CVE-2026-107236, CVE-2026-107237, CVE-2026-107238, CVE-2026-107239, CVE-2026-107240, CVE-2026-107241, CVE-2026-107242, CVE-2026-107243, CVE-2026-107244, CVE-2026-107245, CVE-2026-107246, CVE-2026-107247, CVE-2026-107248, CVE-2026-107249, CVE-2026-107250, CVE-2026-107251, CVE-2026-107252, CVE-2026-107253, CVE-2026-107254, CVE-2026-107255, CVE-2026-107256, CVE-2026-107257, CVE-2026-107258, CVE-2026-107259, CVE-2026-107260, CVE-2026-107261, CVE-2026-107262, CVE-2026-107263, CVE-2026-107264, CVE-2026-107265, CVE-2026-107266, CVE-2026-107267, CVE-2026-107268, CVE-2026-107269, CVE-2026-107270, CVE-2026-107271, CVE-2026-107272, CVE-2026-107273, CVE-2026-107274, CVE-2026-107275, CVE-2026-107276, CVE-2026-107277, CVE-2026-107278, CVE-2026-107279, CVE-2026-107280, CVE-2026-107281, CVE-2026-107282, CVE-2026-107283, CVE-2026-107284, CVE-2026-107285, CVE-2026-107286, CVE-2026-107287, CVE-2026-107288, CVE-2026-107289, CVE-2026-107290, CVE-2026-107291, CVE-2026-107292, CVE-2026-107293, CVE-2026-107294, CVE-2026-107295, CVE-2026-107296, CVE-2026-107297, CVE-2026-107298, CVE-2026-107299, CVE-2026-107300, CVE-2026-107301, CVE-2026-107302, CVE-2026-107303, CVE-2026-107304, CVE-2026-107305, CVE-2026-107306, CVE-2026-107307, CVE-2026-107308, CVE-2026-107309, CVE-2026-107310, CVE-2026-107311, CVE-2026-107312, CVE-2026-107313, CVE-2026-107314, CVE-2026-107315, CVE-2026-107316, CVE-2026-107317, CVE-2026-107318, CVE-2026-107319, CVE-2026-107320, CVE-2026-107321, CVE-2026-107322, CVE-2026-107323, CVE-2026-107324, CVE-2026-107325, CVE-2026-107326, CVE-2026-107327, CVE-2026-107328, CVE-2026-107329, CVE-2026-107330, CVE-2026-107331, CVE-2026-107332, CVE-2026-107333, CVE-2026-107334, CVE-2026-107335, CVE-2026-107336, CVE-2026-107337, CVE-2026-107338, CVE-2026-107339, CVE-2026-107340, CVE-2026-107341, CVE-2026-107342, CVE-2026-107343, CVE-2026-107344, CVE-2026-107345, CVE-2026-107346, CVE-2026-107347, CVE-2026-107348, CVE-2026-107349, CVE-2026-107350, CVE-2026-107351, CVE-2026-107352, CVE-2026-107353, CVE-2026-107354, CVE-2026-107355, CVE-2026-107356, CVE-2026-107357, CVE-2026-107358, CVE-2026-107359, CVE-2026-107360, CVE-2026-107361, CVE-2026-107362, CVE-2026-107363, CVE-2026-107364, CVE-2026-107365, CVE-2026-107366, CVE-2026-107367, CVE-2026-107368, CVE-2026-107369, CVE-2026-107370, CVE-2026-107371, CVE-2026-107372, CVE-2026-107373, CVE-2026-107374, CVE-2026-107375, CVE-2026-107376, CVE-2026-107377, CVE-2026-107378, CVE-2026-107379, CVE-2026-107380, CVE-2026-107381, CVE-2026-107382, CVE-2026-107383, CVE-2026-107384, CVE-2026-107385, CVE-2026-107386, CVE-2026-107387, CVE-2026-107388, CVE-2026-107389, CVE-2026-107390, CVE-2026-107391, CVE-2026-107392, CVE-2026-107393, CVE-2026-107394, CVE-2026-107395, CVE-2026-107396, CVE-2026-107397, CVE-2026-107398, CVE-2026-107399, CVE-2026-107400, CVE-2026-107401, CVE-2026-107402, CVE-2026-107403, CVE-2026-107404, CVE-2

Goal Reached Thanks to every supporter — we hit 100%!

AsyncHttpClient Cookie Source Check Bypass (CVE-2026-107229) Advisory

More from this source