CVE-2026-107280

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, ThreadSafeCookieStore validates Domain attributes with domain matching but does not reject public suffixes. A host beneath a suffix such as co.uk can set a cookie for that suffix, after which the shared cookie store sends it to unrelated hosts under the suffix. This can inject or overwrite session-relevant cookie values across origins. This issue is fixed in versions 3.0.13 and 2.16.1.

• CWE-1275

• https://github.com/AsyncHttpClient/async-http-client/commit/330267895fe0bdb41bbd027ea6b151d38ee7c23d
• https://github.com/AsyncHttpClient/async-http-client/commit/d1f0ccec417092098d40242fee7dfac84bb3c21f
• https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-2.16.1
• https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.13
• https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-f9m8-cv68-674w

Published

Oct 7, 2026

Last Modified

Oct 7, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-107271Gophish through 0.12.1 contains a rate limit bypass vulnerab…5.3
• CVE-2026-107272Gophish through 0.12.1 contains stored and reflected cross-s…4.7
• CVE-2026-107273Gophish 0.11.0 through 0.12.1 contains a server-side request…4.3
• CVE-2026-107276MISP contains a race condition in the email-based one-time p…6.3
• CVE-2026-107278MISP contains a validation flaw in its object synchronizatio…5.3
• CVE-2026-107279The AsyncHttpClient (AHC) library allows Java applications t…8.8
• CVE-2026-107281The AsyncHttpClient (AHC) library allows Java applications t…7.6
• CVE-2026-107282The AsyncHttpClient (AHC) library allows Java applications t…9.4
• CVE-2026-107283The AsyncHttpClient (AHC) library allows Java applications t…3.7
• CVE-2026-107284The AsyncHttpClient (AHC) library allows Java applications t…3.7
• CVE-2026-107285The AsyncHttpClient (AHC) library allows Java applications t…5.9
• CVE-2026-10729An HTML injection vulnerability in the notification email fo…1.2