{"id":"CVE-2026-107226","summary":"AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPS","details":"The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 3.0.14, the default ThreadSafeCookieStore does not retain whether a Set-Cookie response used a secure transport. It accepts Secure cookies received over plaintext and permits insecure cookies to overlay or delete existing Secure cookies with matching scope. An attacker controlling a plaintext same-site response can consequently plant, replace, or remove cookie state later sent to an HTTPS origin, enabling session fixation, CSRF-token replacement, or loss of security-relevant state. This issue is fixed in version 3.0.14.","aliases":["GHSA-p2jm-6hj6-9rjg"],"modified":"2026-10-15T07:09:57.747992126Z","published":"2026-10-12T18:34:18.996Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107226.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-384","CWE-693"]},"references":[{"type":"WEB","url":"https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.14"},{"type":"ADVISORY","url":"https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-p2jm-6hj6-9rjg"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107226.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107226"},{"type":"FIX","url":"https://github.com/AsyncHttpClient/async-http-client/commit/6ec7ee45034d154f502852a962d2891746fb82c1"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/asynchttpclient/async-http-client","events":[{"introduced":"927333da38413759027ccc22a93621da21e7468a"},{"introduced":"9a771c7b40e716ca77a3cad691545b29ff64bfd3"},{"fixed":"6ec7ee45034d154f502852a962d2891746fb82c1"},{"fixed":"bec30bb3d27ad13f069f72b37351c61bff3394ff"}],"database_specific":{"source":["AFFECTED_FIELD","REFERENCES"],"extracted_events":[{"introduced":"2.1.0"},{"last_affected":"2.16.1"},{"introduced":"3.0.0"},{"fixed":"3.0.14"}]}}],"versions":["async-http-client-project-3.0.13","async-http-client-project-3.0.12","async-http-client-project-3.0.11","async-http-client-project-3.0.10","async-http-client-project-3.0.9","async-http-client-project-3.0.8","async-http-client-project-3.0.7","async-http-client-project-3.0.6","async-http-client-project-3.0.5","async-http-client-project-3.0.4","async-http-client-project-3.0.3","async-http-client-project-3.0.2","async-http-client-project-3.0.1","async-http-client-project-3.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107226.json","vanir_signatures":[{"id":"CVE-2026-107226-31d4ab90","signature_type":"Function","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/6ec7ee45034d154f502852a962d2891746fb82c1","target":{"file":"client/src/main/java/org/asynchttpclient/cookie/ThreadSafeCookieStore.java","function":"get"},"deprecated":false,"digest":{"function_hash":"217316347161903099556215415952455512795","length":456}},{"digest":{"function_hash":"338238052402395334986647125986560981216","length":199},"id":"CVE-2026-107226-421f3015","signature_type":"Function","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/6ec7ee45034d154f502852a962d2891746fb82c1","target":{"function":"StoredCookie","file":"client/src/main/java/org/asynchttpclient/cookie/ThreadSafeCookieStore.java"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/6ec7ee45034d154f502852a962d2891746fb82c1","target":{"file":"client/src/main/java/org/asynchttpclient/cookie/ThreadSafeCookieStore.java","function":"evictExcessCookies"},"deprecated":false,"digest":{"length":647,"function_hash":"50120323587878703493181012720680118917"},"id":"CVE-2026-107226-5b36520c"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/6ec7ee45034d154f502852a962d2891746fb82c1","target":{"file":"client/src/main/java/org/asynchttpclient/cookie/ThreadSafeCookieStore.java","function":"add"},"deprecated":false,"digest":{"length":147,"function_hash":"337224062245123061888496665919318703397"},"id":"CVE-2026-107226-7ba550b7"},{"deprecated":false,"digest":{"function_hash":"51198981783142500730955291392248918574","length":496},"id":"CVE-2026-107226-a4793acb","signature_type":"Function","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/6ec7ee45034d154f502852a962d2891746fb82c1","target":{"file":"client/src/main/java/org/asynchttpclient/cookie/ThreadSafeCookieStore.java","function":"collectStoredCookies"}},{"digest":{"line_hashes":["17547544152233955470519640309964215367","231089287870838049348029442804543332096","202254432987872229808474210088917912645","300725193936492699661608649082479798035","73706372020235715699056767056929898330","266803429523453382036054394858743666814","157630181127334803733645047474927203109","207361445703506846747268341338318410798","141754358475766280606340836050977863913","68640273773280602619254747318862187351","332245135540948207948460436388853163340","95324149186542638835448659557811928198","218697952462100442345652514143188832280","329351705518537503653313956284890618362","297540463132978859000604300961123354391","90393287136095257504311332244076562553","288910095540435382256974476969230111638","73337062200638342948222412190087136537","290318488932673391226709554233405465636","106119934520897467637114221613482832294","333410414319324611249549284310311873877","329509958191803131595341287711463769729","139753596148425771615999418951871398521","304586063201920950865679526506638313500","248438227701654675501543919495202289611","215148634534661225447083255330672569929","269387465381265884805397241280190338812","296792048567850113856036180407346533397","97736347333294291922283700192568818510","187461201768143226599793743157557886193","302190641883326527179998463191360793027","262245750624249981117058746882114719863","273319746795889848710821736443027082142","300987216748814170155539064267482179484","8619707425851083094028206771325273360","156632936607380354922422243116052436900","106971851962736637760646789697270711013","288784280086526230282360642688496239209","136367705460047242153497722535292068473","266653017854504597785695437514758024105","55029539335615147714140267731568912750","18096092445179726134384417350636282098","240966578768638154826861599380853063237","109563960295366603875223310823575824071","229752606933640498682610966491841295761","311049525285794685723264305745708170986","188064030324008736890698252215970552852","323170553180638219679427287126762774184","74664456148915340930828661875309650276","323911390963908337488208741810608104294","280077063132267929428354771298183646188","292683017916814361691973266207471854142","252169236763583218197353422978509392865","307753741152924173828260281832246969371","199706864300365705074857039560408682507","265853554354423936980221948243890104140","90985038946937932224326982642249744184","177549416811403656290812049633083817119","56206458745863794508385929890181315745","218778276989554679983110934403543954741","261905301178395956478001295060512009329","189618038809911297459897088954175876542","242206463717125746919693286409597514489","196253891309321195376627509497246768849"],"threshold":0.9},"id":"CVE-2026-107226-d2463683","signature_type":"Line","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/6ec7ee45034d154f502852a962d2891746fb82c1","target":{"file":"client/src/main/java/org/asynchttpclient/cookie/ThreadSafeCookieStore.java"},"deprecated":false},{"digest":{"function_hash":"248518704993970841770080760647090300487","length":119},"id":"CVE-2026-107226-dfc0f653","signature_type":"Function","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/6ec7ee45034d154f502852a962d2891746fb82c1","target":{"file":"client/src/main/java/org/asynchttpclient/cookie/ThreadSafeCookieStore.java","function":"get"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"283702288138594927279494313800060740631","length":948},"id":"CVE-2026-107226-eef1f629","signature_type":"Function","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/6ec7ee45034d154f502852a962d2891746fb82c1","target":{"function":"add","file":"client/src/main/java/org/asynchttpclient/cookie/ThreadSafeCookieStore.java"}}],"vanir_signatures_modified":"2026-10-15T07:09:57Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N"}]}