CVE-2026-107226

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 3.0.14, the default ThreadSafeCookieStore does not retain whether a Set-Cookie response used a secure transport. It accepts Secure cookies received over plaintext and permits insecure cookies to overlay or delete existing Secure cookies with matching scope. An attacker controlling a plaintext same-site response can consequently plant, replace, or remove cookie state later sent to an HTTPS origin, enabling session fixation, CSRF-token replacement, or loss of security-relevant state. This issue is fixed in version 3.0.14.

• CWE-384
• CWE-693

• https://github.com/AsyncHttpClient/async-http-client/commit/6ec7ee45034d154f502852a962d2891746fb82c1
• https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.14
• https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-p2jm-6hj6-9rjg

Published

Oct 12, 2026

Last Modified

Oct 16, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-107220Excelize is a Go language library for reading and writing Mi…6.5
• CVE-2026-107221Excelize is a Go language library for reading and writing Mi…6.5
• CVE-2026-107222Excelize is a Go language library for reading and writing Mi…6.5
• CVE-2026-107223Excelize is a Go language library for reading and writing Mi…7.5
• CVE-2026-107224Excelize is a Go language library for reading and writing Mi…6.5
• CVE-2026-107225Excelize is a Go language library for reading and writing Mi…6.5
• CVE-2026-107227The AsyncHttpClient (AHC) library allows Java applications t…7.5
• CVE-2026-107228The AsyncHttpClient (AHC) library allows Java applications t…6.8
• CVE-2026-107229The AsyncHttpClient (AHC) library allows Java applications t…4
• CVE-2026-10723BIND may accept incorrect child-zone NSEC3 records as valid,…6.8
• CVE-2026-107230The AsyncHttpClient (AHC) library allows Java applications t…7.4
• CVE-2026-107231The AsyncHttpClient (AHC) library allows Java applications t…8.7