CVE-2026-107280: AsyncHttpClient cookie domain validation bypass via public suffix

CVE-2026-107280 · Severity: medium · CVSS 4 · Published 2026-10-08

AsyncHttpClient, an HTTP client library used in many applications, does not properly validate cookie domain restrictions against the public suffix list. An attacker controlling a subdomain under a public suffix (such as attacker.co.uk) can set cookies for the entire suffix (co.uk), which are then sent to all other subdomains like bank.co.uk, enabling session fixation or credential theft attacks.

Technologies: AsyncHttpClient. Vendors: AsyncHttpClient.

Quick answers

Is CVE-2026-107280 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-107280 being exploited in the wild.
How severe is CVE-2026-107280?
Medium severity, with a CVSS score of 4, published 8 October 2026.
Which products and versions are affected?
AsyncHttpClient 3.x up to 3.0.12, 2.x up to 2.16.0.
Is there a fix for CVE-2026-107280?
Yes: fixed in 3.0.13. Until then: Do not share a single CookieStore across origins that are not mutually trusted. Alternatively, provide a custom CookieStore implementation that explicitly rejects Domain values matching public suffixes. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-107280 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-107280?
Check whether you run AsyncHttpClient at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: 3.0.13

Do not share a single CookieStore across origins that are not mutually trusted. Alternatively, provide a custom CookieStore implementation that explicitly rejects Domain values matching public suffixes.

Technical details

The vulnerability exists in ThreadSafeCookieStore.domainsMatch, which only implements RFC 6265 Section 5.1.3 domain matching without the required RFC 6265 Section 5.3 step 5 public suffix check. An attacker on attacker.co.uk can set Domain=co.uk, and the cookie will be sent to bank.co.uk and all other hosts under the public suffix. The fix in version 3.0.13 bundles the ICANN section of the Mozilla public suffix list, but the list becomes stale and does not reflect additions made after release.

Affected products

  • AsyncHttpClient AsyncHttpClient 3.x up to 3.0.12, 2.x up to 2.16.0

Identifiers

  • CVE-2026-107280
  • GHSA-f9m8-cv68-674w

Timeline

  • 2026-10-08: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.