# CVE-2026-107226: AsyncHttpClient cookie security bypass in HTTP

Source: https://junglewise.ai/threats/cve-2026-107226-asynchttpclient-cookies-received-over-plaintext-http-can-plant  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-12. Updated: 2026-10-08  
License: CC BY 4.0 with a link back

CVE-2026-107226 · Severity: medium · CVSS 6.8 · Published 2026-10-12

AsyncHttpClient is a library used to fetch web content over HTTP and HTTPS. An attacker who controls a plaintext HTTP endpoint on the same website can inject, overwrite, or delete secure cookies intended only for HTTPS connections. This can lead to session hijacking, CSRF token theft, or removal of security-critical cookies that protect the user's account.

Technologies: [AsyncHttpClient](https://junglewise.ai/threats/technologies/asynchttpclient). Vendors: [AsyncHttpClient](https://junglewise.ai/threats/vendors/asynchttpclient).

## Quick answers

**Is CVE-2026-107226 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-107226 being exploited in the wild.

**How severe is CVE-2026-107226?** Medium severity, with a CVSS score of 6.8, published 12 October 2026.

**Which products and versions are affected?** AsyncHttpClient 2.1.0 to 2.16.1 (2.x line); 3.x up to 3.0.13.

**Is there a fix for CVE-2026-107226?** Yes: fixed in 3.0.14. Until then: Do not share a single CookieStore between plaintext HTTP and HTTPS origins that are not mutually trusted, or disable the cookie store entirely. Upgrade to version 3.0.14 (the 2.x line is end-of-life and receives no patch). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-107226 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-107226?** Check whether you run AsyncHttpClient at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 3.0.14

Do not share a single CookieStore between plaintext HTTP and HTTPS origins that are not mutually trusted, or disable the cookie store entirely. Upgrade to version 3.0.14 (the 2.x line is end-of-life and receives no patch).

## Technical details

The vulnerability is a failure to enforce RFC 6265bis Section 5 rules on cookie storage: cookies with the Secure attribute arriving over plaintext HTTP are stored instead of being rejected, and non-Secure cookies are not checked before overwriting Secure cookies. An attacker controlling an HTTP origin under the same domain can set, replace, or delete Secure cookies via plaintext Set-Cookie responses, which are then sent back over HTTPS in subsequent TLS-encrypted requests. The fix validates the connection scheme at storage time and implements proper cookie ordering to prevent plaintext cookies from shadowing Secure ones.

## Affected products

- AsyncHttpClient AsyncHttpClient 2.1.0 to 2.16.1 (2.x line); 3.x up to 3.0.13

## Identifiers

- CVE-2026-107226
- GHSA-p2jm-6hj6-9rjg

## Timeline

- 2026-10-08: disclosed

## Related threats

- [AsyncHttpClient resumable download information disclosure and file tampering](https://junglewise.ai/threats/cve-2026-102740-the-asynchttpclient-library-allows-java-applications-to-execute)
- [AsyncHttpClient CookieStore header override via setHeader](https://junglewise.ai/threats/cve-2026-107228-asynchttpclient-cookiestore-silently-overrides-caller-s-explicit)
- [AsyncHttpClient unbounded WebSocket decompression denial of service](https://junglewise.ai/threats/cve-2026-107227-asynchttpclient-unbounded-websocket-permessage-deflate)
- [AsyncHttpClient pooled connection reuse across NTLM and Negotiate logins](https://junglewise.ai/threats/cve-2026-107230-asynchttpclient-pooled-connections-can-still-be-shared-across)
- [AsyncHttpClient WebSocket proxy credentials sent to origin server](https://junglewise.ai/threats/cve-2026-107285-asynchttpclient-websocket-proxy-credentials-sent-to-the-origin)