Junglewise Threat Intelligence

CVE-2026-55688: AsyncHttpClient cookie injection in ThreadSafeCookieStore

CVE-2026-55688 · Severity: medium · CVSS 4 · Published 2026-07-01

Executive brief

AsyncHttpClient is a popular HTTP client library used by Java applications to fetch web content and communicate with services. The library's cookie storage mechanism fails to validate that a responding server is permitted to set cookies for unrelated domains, allowing an attacker to plant cookies on victim domains. This can lead to session hijacking or CSRF token injection attacks when applications make requests to both attacker-controlled and trusted hosts.

Technical details

The vulnerability is a cookie tossing/injection issue (CWE-1275) in ThreadSafeCookieStore. When a server responds with a Set-Cookie header, the library stores the cookie using the Domain attribute value without verifying that the responding host is allowed to set cookies for that domain per RFC 6265 §5.3 step 6. An attacker hosting a server that a shared AsyncHttpClient instance connects to can therefore set a cookie scoped to an arbitrary unrelated domain (e.g., a trusted payment processor). On subsequent requests to the victim domain, the client automatically sends the attacker-injected cookie. This requires the vulnerable application to use a single shared AsyncHttpClient instance to reach both attacker-influenced and trusted hosts—common in crawlers, webhook fetchers, SSRF features, and redirect-following scenarios. The attacker can write cookies (enabling session fixation, CSRF token overwrites) but cannot read victim cookies. Patches are available in 2.16.0 and 3.0.11; workarounds include disabling the cookie store or using separate client instances per trust domain.

Affected products

  • AsyncHttpClient async-http-client 2.0.0 to 2.15.x and 3.0.0.Beta1 to 3.0.10

Timeline

  • 2026-06-15: disclosed: Advisory published by AsyncHttpClient team
  • 2026-06-15: patched: Patches released: version 2.16.0 and 3.0.11
  • 2026-08-26: advisory: GitHub Advisory Database entry published

References

Related threats