CVE-2026-107229: asynchttpclient async-http-client Session Fixation

Vulnerability summary

CVE-2026-107229 is a medium (CVSS 4.0) Session Fixation vulnerability in asynchttpclient async-http-client. EPSS estimates a 0.26% chance of exploitation in the next 30 days, higher than 16.7% of scored vulnerabilities.

Timeline

1. 07-10-2026
   PublishedVulnerability first disclosed.
2. 08-10-2026
   Last modifiedVulnerability information updated.

Description

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.16.0 until 3.0.14, ThreadSafeCookieStore incompletely validates cookie Domain attributes. Missing private-section and default public-suffix rules, absent A-label normalization, locale-sensitive lowercasing, public-suffix host-only handling, and numeric or IP host checks allow one origin to store a cookie later sent to another origin. Applications sharing one client across trust domains can therefore receive attacker-injected cookies and may be exposed to session fixation. This issue is fixed in version 3.0.14.

• CWE-384Session FixationAuthenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
• CWE-1275Sensitive Cookie with Improper SameSite AttributeThe SameSite attribute for sensitive cookies is not set, or an insecure value is used.