CVE-2026-55688: AsyncHttpClient Cookie Injection Vulnerability – Patch Guidance

Technical summary

The ThreadSafeCookieStore class in AsyncHttpClient fails to validate the Domain attribute of Set-Cookie headers against RFC 6265 restrictions. Specifically, it does not verify that the responding host is authorized to set cookies for a given domain before accepting and storing them. An attacker can craft a Set-Cookie response with an arbitrary Domain value; the library will store this cookie and automatically attach it to subsequent requests matching that domain. The vulnerability affects two release lines: versions 2.0.0 through 2.15.x, and versions from 3.0.0.Beta1 through 3.0.10. Remediation is available in AHC 2.16.0 and 3.0.11, which enforce proper domain validation during cookie acceptance.

Business impact

Organizations using AsyncHttpClient for multi-domain HTTP operations face session hijacking and request forgery risks. An attacker who can intercept or control a connection to any server that your application contacts—whether directly or through a supply chain dependency—can inject cookies targeting your internal or external trusted services. If that trusted service relies on cookies for authentication or authorization decisions, the injected cookie may grant unauthorized access or facilitate lateral movement. The impact scales with the number of distinct hosts your application communicates with; applications talking to untrusted or user-controlled endpoints are at elevated risk.

Affected systems

All Java applications using AsyncHttpClient versions 2.0.0–2.15.x or 3.0.0.Beta1–3.0.10 are affected, provided they create a single, shared client instance (or rely on the library's default shared instance) to reach multiple hosts. Direct consumers of the AHC library are the primary target, but downstream applications that depend on libraries that embed AsyncHttpClient are also in scope. Verify your application's dependency tree and AHC version to confirm exposure.

Exploitability

The vulnerability requires the attacker to control or influence a host that your application connects to and to craft a malicious Set-Cookie response. The attack does not require user interaction or elevated privileges. However, practical exploitation depends on application architecture: only applications that pool a single HTTP client across multiple origins are vulnerable. The CVSS score of 4.0 (Medium) reflects this constraint, as the attack has moderate attack complexity and limited immediate consequence (integrity impact only, no confidentiality or availability loss from the cookie injection alone).

Remediation

Upgrade AsyncHttpClient to version 2.16.0 or later for the 2.x series, or to version 3.0.11 or later for the 3.x series. These versions implement proper domain validation in the cookie store, preventing acceptance of cookies from hosts unauthorized to set them. After upgrading, no configuration changes are necessary; the fix operates transparently. If you cannot upgrade immediately, consider using a per-host CookieStore (if your application architecture permits) to isolate cookies between untrusted and trusted endpoints.

Patch guidance

1. Audit your dependencies to identify all direct and transitive uses of AsyncHttpClient. Use build-time dependency scanning (Maven, Gradle plugins) to surface the current version. 2. Plan a staged upgrade to AHC 2.16.0 or 3.0.11, beginning with non-production environments. 3. Review your application's HTTP client initialization: confirm whether you are using a shared, default CookieStore or per-host instances. 4. Test cookie-based authentication flows in your trusted services post-upgrade to ensure no regression. 5. If you maintain libraries that embed AsyncHttpClient, release a patch version with the updated dependency and notify your consumers.

Detection guidance

Monitor HTTP request logs for anomalous Set-Cookie headers originating from external or less-trusted services. Cross-reference the Domain attribute in responses against the Host header of the request: a mismatch may indicate an injection attempt. Application-level logging of cookie operations (where feasible) can help correlate suspicious cookie additions with specific HTTP responses. Additionally, runtime dependency scanning tools can flag AsyncHttpClient versions below 2.16.0 or 3.0.11 as needing remediation.

Why prioritize this

Although the CVSS score is moderate (4.0), the practical risk to most applications is lower because successful exploitation requires a shared client instance and attacker control of an upstream host. However, if your application handles sensitive authentication or communicates with user-supplied or third-party URLs, prioritize patching to close the vector. The fix is low-risk (a pure validation improvement) and has been available since July 2026, reducing deployment friction.

Risk score, explained

The CVSS 3.1 score of 4.0 Medium reflects low attack complexity, no privilege requirement, and network-based attack vector, but recognizes that the scope is changed (cookies affect cross-domain behavior) and the immediate integrity impact is limited to injection, not full compromise. The score penalizes exploitability because applications must satisfy a specific architectural condition (shared client, multi-host usage) and the attacker must control or influence a contacted host. Real-world risk is context-dependent: applications handling authentication or high-value transactions are at the upper end of the Medium range.

Frequently asked questions