CVE-2026-107280CWE-1275

CVE-2026-107280

published October 8, 2026

CVSS
6.9
EPSS
0%
Percentile
16.9
In the wild
Unconfirmed
What it is

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, ThreadSafeCookieStore validates Domain attributes with domain matching but does not reject public suffixes. A host beneath a suffix such as co.uk can set a cookie for that suffix, after which the shared cookie store sends it to unrelated hosts under the suffix. This can inject or overwrite session-relevant cookie values across origins. This issue is fixed in versions 3.0.13 and 2.16.1.

The record
Technical detail
CVSS
6.9 · NONE
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N
EPSS
0.00260 · 16.9th percentile
Weakness
CWE-1275 · Sensitive Cookie with Improper SameSite Attribute
Published
2026-10-08T02:17Z
References (5)
https://github.com/AsyncHttpClient/async-http-client/commit/330267895fe0bdb41bbd027ea6b151d38ee7c23d · [email protected]https://github.com/AsyncHttpClient/async-http-client/commit/d1f0ccec417092098d40242fee7dfac84bb3c21f · [email protected]https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-2.16.1 · [email protected]https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.13 · [email protected]https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-f9m8-cv68-674w · [email protected]
EPSS history
Timeline
  • 09 OCT 03:26Z
    EPSS moved — → 0%
    epss
  • 07 OCT 21:15Z
    AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.uk
    cvelistv5
  • 07 OCT 21:15Z
    AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.uk
    cvelistv5