CVE-2026-55688: AsyncHttpClient cookie injection in ThreadSafeCookieStore

CVE-2026-55688 · Severity: medium · CVSS 4 · Published 2026-07-01

AsyncHttpClient is a popular HTTP client library used by Java applications to fetch web content and communicate with services. The library's cookie storage mechanism fails to validate that a responding server is permitted to set cookies for unrelated domains, allowing an attacker to plant cookies on victim domains. This can lead to session hijacking or CSRF token injection attacks when applications make requests to both attacker-controlled and trusted hosts.

Technologies: AsyncHttpClient, org.asynchttpclient:async-http-client (Maven). Vendors: AsyncHttpClient, Maven.

Quick answers

Is CVE-2026-55688 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-55688 being exploited in the wild.
How severe is CVE-2026-55688?
Medium severity, with a CVSS score of 4, published 1 July 2026.
Which products and versions are affected?
AsyncHttpClient >= 2.0.0, < 2.16.0; >= 3.0.0.Beta1, < 3.0.11; org.asynchttpclient:async-http-client (Maven) ECOSYSTEM:introduced=3.0.0.Beta1,fixed=3.0.11.
Is there a fix for CVE-2026-55688?
Yes. org.asynchttpclient:async-http-client (Maven): upgrade to 3.0.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55688 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-55688?
Check whether you run AsyncHttpClient or org.asynchttpclient:async-http-client (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.asynchttpclient:async-http-client (Maven): upgrade to 3.0.11 or later
    # set org.asynchttpclient:async-http-client to 3.0.11 in your pom.xml or build.gradle

Technical details

The vulnerability is a cookie tossing/injection issue (CWE-1275) in ThreadSafeCookieStore. When a server responds with a Set-Cookie header, the library stores the cookie using the Domain attribute value without verifying that the responding host is allowed to set cookies for that domain per RFC 6265 §5.3 step 6. An attacker hosting a server that a shared AsyncHttpClient instance connects to can therefore set a cookie scoped to an arbitrary unrelated domain (e.g., a trusted payment processor). On subsequent requests to the victim domain, the client automatically sends the attacker-injected cookie. This requires the vulnerable application to use a single shared AsyncHttpClient instance to reach both attacker-influenced and trusted hosts—common in crawlers, webhook fetchers, SSRF features, and redirect-following scenarios. The attacker can write cookies (enabling session fixation, CSRF token overwrites) but cannot read victim cookies. Patches are available in 2.16.0 and 3.0.11; workarounds include disabling the cookie store or using separate client instances per trust domain.

Affected products

  • AsyncHttpClient async-http-client 2.0.0 to 2.15.x and 3.0.0.Beta1 to 3.0.10

Identifiers

  • CVE-2026-55688
  • GHSA-m452-q8c9-rg2f

Timeline

  • 2026-06-15: disclosed: Advisory published by AsyncHttpClient team
  • 2026-06-15: patched: Patches released: version 2.16.0 and 3.0.11
  • 2026-08-26: advisory: GitHub Advisory Database entry published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.