Is CVE-2026-107228 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-107228 being exploited in the wild.

How severe is CVE-2026-107228?

Medium severity, with a CVSS score of 6.8, published 8 October 2026.

Which products and versions are affected?

AsyncHttpClient 2.1.0 through 2.16.1, 3.x through 3.0.13.

How is CVE-2026-107228 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-107228?

Check whether you run AsyncHttpClient at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107228: AsyncHttpClient CookieStore header override via setHeader

CVE-2026-107228 · Severity: medium · CVSS 6.8 · Published 2026-10-08

AsyncHttpClient, a library for making web requests, silently replaces cookie headers set by an application with cookies from its internal store when enabled (the default). In multi-user scenarios where a single shared client handles requests for different users, an attacker could have their request processed under another user's session if that session cookie is in the store, leading to unauthorized access and account takeover.

Technologies: AsyncHttpClient. Vendors: AsyncHttpClient.

Quick answers

Is CVE-2026-107228 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-107228 being exploited in the wild.
How severe is CVE-2026-107228?: Medium severity, with a CVSS score of 6.8, published 8 October 2026.
Which products and versions are affected?: AsyncHttpClient 2.1.0 through 2.16.1, 3.x through 3.0.13.
Is there a fix for CVE-2026-107228?: Yes: fixed in 3.0.14. Until then: For applications that attach per-user cookies to requests, either use a separate client instance per user or disable the cookie store by calling setCookieStore(null). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-107228 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-107228?: Check whether you run AsyncHttpClient at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 3.0.14

For applications that attach per-user cookies to requests, either use a separate client instance per user or disable the cookie store by calling setCookieStore(null).

Technical details

The vulnerability occurs in the cookie store implementation when a caller explicitly sets a Cookie header via setHeader() or addHeader(); the store overwrites this header with its own cookies instead of merging them. This bypasses the CVE-2024-53990 fix which only addressed cookies added via addCookie(). An attacker can perform session hijacking when one client instance and its store are shared across requests for multiple users, causing a request to be executed under a different user's session credential.

Affected products

AsyncHttpClient AsyncHttpClient 2.1.0 through 2.16.1, 3.x through 3.0.13

Identifiers

CVE-2026-107228
GHSA-2jwh-9rmr-j4xf

Timeline

2026-10-08: disclosed
2026-10-08: patched: Fixed in 3.0.14; 2.x line is end-of-life and will not receive a patch

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.