Skip to content
OpenAdvisories
Medium USN-8655-1 1 CVE

async-http-client vulnerability

Published Aug 20, 2026 · Updated Aug 26, 2026

Ecosystem: Ubuntu

Summary

It was discovered that AsyncHttpClient did not properly verify that the
responding host was allowed to set cookies for a given domain in its
ThreadSafeCookieStore. An attacker could use this to plant cookies scoped to
unrelated domains, which would then be sent on later requests to those
domains.

Fixed packages 4

ReleasePackageFixed in
Ubuntu · 22.04 LTS 22.04:LTS async-http-client 2.12.3-1ubuntu0.22.04.1
Ubuntu · 24.04 LTS 24.04:LTS async-http-client 2.12.3-1ubuntu0.24.04.1
Ubuntu · 26.04 LTS 26.04:LTS async-http-client 2.12.3-1ubuntu1.1
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS async-http-client 2.6.0-1ubuntu0.1~esm1

Vulnerabilities 1

  • Medium 4.0
    CVE-2026-55688

    AsyncHttpClient: Cookie stored for an unrelated domain (cookie tossing) via ThreadSafeCookieStore

    The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. In versions from 2.0.0 prior to 2.16.0 and from 3.0.0.Beta1 prior to 3.0.11, ThreadSafeCookieStore stored a cookie under the …

    AsyncHttpClient async-http-client druid tez Debian Ubuntu Wolfi Maven

References

  • report
    https://ubuntu.com/security/CVE-2026-55688