{"id":"CVE-2026-55688","summary":"AsyncHttpClient: Cookie stored for an unrelated domain (cookie tossing) via ThreadSafeCookieStore","details":"The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. In versions from 2.0.0 prior to 2.16.0 and from 3.0.0.Beta1 prior to 3.0.11, ThreadSafeCookieStore stored a cookie under the value of its Domain attribute without verifying that the responding host is allowed to set a cookie for that domain, leading to a cookie tossing / cookie injection issue. A host the client connects to can therefore plant a cookie scoped to an unrelated domain, and the client will then send that cookie on later requests to that domain. Applications that use a single AsyncHttpClient instance - and thus the default, shared CookieStore - to reach both an attacker-influenced host and a trusted host are impacted. This issue has been fixed in versions 2.16.0 and 3.0.11.","aliases":["GHSA-m452-q8c9-rg2f"],"modified":"2026-08-28T04:10:58.143466202Z","published":"2026-07-01T19:40:12.004Z","related":["CGA-v485-2jrm-hrh2"],"database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-1275"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55688.json"},"references":[{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2026/08/msg00011.html"},{"type":"ADVISORY","url":"https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-m452-q8c9-rg2f"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55688.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55688"},{"type":"FIX","url":"https://github.com/AsyncHttpClient/async-http-client/pull/2196"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/asynchttpclient/async-http-client","events":[{"introduced":"b60e5a0d7d989e4a24c13e03ba786c375b727448"},{"fixed":"8e4069cf3c92abe099db5fb13378ac2fe9e1fd3b"},{"introduced":"0"},{"fixed":"a374830195d5c36946cc73a8b1b91d1583514841"}],"database_specific":{"extracted_events":[{"introduced":"2.0.0"},{"fixed":"2.16.0"},{"introduced":"3.0.0.Beta1"},{"fixed":"3.0.11"}],"source":"AFFECTED_FIELD"}}],"versions":["async-http-client-project-2.15.0","async-http-client-project-3.0.10","async-http-client-project-3.0.9","async-http-client-project-2.14.5","async-http-client-project-2.12.4","async-http-client-project-3.0.8","async-http-client-project-3.0.7","async-http-client-project-3.0.6","async-http-client-project-3.0.5","async-http-client-project-3.0.4","async-http-client-project-3.0.3","async-http-client-project-3.0.2","async-http-client-project-2.12.3","async-http-client-project-3.0.1","async-http-client-project-3.0.0","async-http-client-project-3.0.0.Beta3","async-http-client-project-3.0.0.Beta2","async-http-client-project-2.12.2","async-http-client-project-2.12.1","async-http-client-project-2.12.0","async-http-client-project-2.11.0","async-http-client-project-2.10.5","async-http-client-project-2.10.4","async-http-client-project-2.10.3","async-http-client-project-2.10.2","async-http-client-project-2.10.1","async-http-client-project-2.10.0","async-http-client-project-2.9.0","async-http-client-project-2.8.1","async-http-client-project-2.8.0","async-http-client-project-2.7.0","async-http-client-project-2.6.0","async-http-client-project-2.5.4","async-http-client-project-2.5.3","async-http-client-project-2.5.2","async-http-client-project-2.5.1","async-http-client-project-2.5.0","async-http-client-project-2.4.9","async-http-client-project-2.4.8","async-http-client-project-2.4.7","async-http-client-project-2.4.6","async-http-client-project-2.4.5","async-http-client-project-2.4.4","async-http-client-project-2.4.3","async-http-client-project-2.4.2","async-http-client-project-2.4.1","async-http-client-project-2.4.0","async-http-client-project-2.3.0","async-http-client-project-2.2.1","async-http-client-project-2.2.0","async-http-client-project-2.1.2","async-http-client-project-2.1.1","async-http-client-project-2.1.0","async-http-client-project-2.1.0-RC4","async-http-client-project-2.1.0-RC3","async-http-client-project-2.1.0-RC2","async-http-client-project-2.1.0-RC1","async-http-client-project-2.1.0-alpha26","async-http-client-project-2.1.0-alpha25","async-http-client-project-2.1.0-alpha24","async-http-client-project-2.1.0-alpha23","async-http-client-project-2.1.0-alpha22","async-http-client-project-2.1.0-alpha21","async-http-client-project-2.1.0-alpha20","async-http-client-project-2.1.0-alpha19","async-http-client-project-2.1.0-alpha18","async-http-client-project-2.1.0-alpha17","async-http-client-project-2.1.0-alpha16","async-http-client-project-2.1.0-alpha15","async-http-client-project-2.1.0-alpha14","async-http-client-project-2.1.0-alpha13","async-http-client-project-2.1.0-alpha12","async-http-client-project-2.1.0-alpha11","async-http-client-project-2.1.0-alpha10","async-http-client-project-2.1.0-alpha9","async-http-client-project-2.1.0-alpha8","async-http-client-project-2.1.0-alpha7","async-http-client-project-2.1.0-alpha6","async-http-client-project-2.1.0-alpha5","async-http-client-project-2.1.0-alpha4","async-http-client-project-2.1.0-alpha3","async-http-client-project-2.1.0-alpha2","async-http-client-project-2.0.24","async-http-client-project-2.0.23","async-http-client-project-2.0.22","async-http-client-project-2.0.21","async-http-client-project-2.0.20","async-http-client-project-2.0.19","async-http-client-project-2.0.18","async-http-client-project-2.0.17","async-http-client-project-2.0.16","async-http-client-project-2.0.15","async-http-client-project-2.0.14","async-http-client-project-2.0.13","async-http-client-project-2.0.12","async-http-client-project-2.0.11","async-http-client-project-2.0.10","async-http-client-project-2.0.9","async-http-client-project-2.0.8","async-http-client-project-2.0.7","async-http-client-project-2.0.6","async-http-client-project-2.0.5","async-http-client-project-2.0.4","async-http-client-project-2.0.3","async-http-client-project-2.0.2","async-http-client-project-2.0.1","async-http-client-project-2.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55688.json","vanir_signatures_modified":"2026-08-12T16:41:21Z","vanir_signatures":[{"id":"CVE-2026-55688-06063aec","signature_type":"Function","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841","target":{"file":"client/src/main/java/org/asynchttpclient/netty/channel/Http2ConnectionState.java","function":"failPendingOpeners"},"deprecated":false,"digest":{"function_hash":"44975579509482547796929415059736372416","length":327}},{"deprecated":false,"digest":{"length":676,"function_hash":"296700625155990128381699229250756753105"},"id":"CVE-2026-55688-062fc495","signature_type":"Function","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841","target":{"file":"client/src/main/java/org/asynchttpclient/netty/request/body/NettyBodyBody.java","function":"writeHttp2"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841","target":{"file":"client/src/main/java/org/asynchttpclient/netty/channel/Http2ConnectionState.java"},"deprecated":false,"digest":{"line_hashes":["66353816393948610465640071874358599060","35308391353028351047240930206124859650","282441467923727243482924918725562656160","11519708396642306768317595505269948169","225200936621203192959380021319234322409","160303418982299148444497851108039446188","300831267659452715708208641226784191926","180821845151439604975882881031261586042","335718780355233395297631058319805978441","335113890496296953035822630695275774510","171869641833338953541694454702770655384","293330140989696916165180066052707925467","149274859611007636196341016424657425610","112561460209307833380074760902164545279","94236156674998454197692827156980800003","316205818859795747471717291913709269400","268070654145490106305704594352130143447","271328056780873899799391498920785639233","101527035609062652968353036492671207129","101982956185370935582634388850870197328","38574607982236247394632632873181100408","92519068849816447307278865816663557899","257370819034713042174494219143873879534","264250601602314187021872154731153132811","155069998730465509408563944799685302915","303891523450830975886547822071709613607","52317908348607500759038391207130582672","92343166313397357680242902796050123992","287513725331046405546235080535560817354","101092394822257697744099942146477851483","220001843139839937567322889133188044357","33591276877287026892896601682868491613","21043134715269664204436988083293621120","108587633537507210242609878158511307392","153347004142734436433786707547856625513","131449213129789546701294834845604727686","191066590484138786622285781173692804592","202551752738896923615678257639701647243","149258456836056734570493270930444453448","239517702362199352366246097113720053894","16040855383711605731873859050995334371","157138979815360474822173661892435017549","247460361513995900026113597640723948903","200954639384020889982429585812987107971","37309178804951720828965788766351721689","193459236542493488137889890841025902469","30315164336467555955266071962719576263","142017936197813123984045005042570979210","187963895566370372490631228114749291689","297550495264964601200147231034137308738","289175974947757586899988472577109695747","200266760314516268817612035065448384295"],"threshold":0.9},"id":"CVE-2026-55688-09fca8ce"},{"target":{"file":"client/src/main/java/org/asynchttpclient/netty/request/body/NettyInputStreamBody.java"},"deprecated":false,"digest":{"line_hashes":["242250493679994314132694752406105459307","119478040034929904717843503902460816388","134348603463405165225569330065034686670","36524855504918587287391462379405395736","237186804977069426748323423062675845937","37819928813824924460478232220385026570","8106939934178307541358778535197855240","50212362452578065505907049194139850339","201253331875016951360261220037677127748","70005005353871734753287315931418518425","128181155288660839166551230282268657089","19694594199891769829050549362511967841","174203533653798107372468592522510861982","227876663145642276015265252969243466693","20586162578199137518971701370810526240","285943468217458678185028982473838981917","188519978991228650459674477467888432343","334329571144545721476460363199177920867","222722536360366219043188065991632827909","267958417761499678001707489934473885014","296801064023302773759194481231997397220","227209310640742311740714277834120580948","55924631672034263402623580597187830075","61733901935397966076329699146656555901","74899881096606278272589085391519212773","83140913580940856236847688469755972084","255069459670660148643073613385987983820","336421145927775472855118539803013243531","26425960058003503354921305046070411298","271480802128666347613602299773792263838","277602755914854912184251271334177210446","107037793189982159901034341098328835228","26383279938739521069636673587667012893"],"threshold":0.9},"id":"CVE-2026-55688-179345ad","signature_type":"Line","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841"},{"digest":{"line_hashes":["206873690685477244434521360242820995681","205842803213208165473724997029828324463","98421564311458972147563533820343249757"],"threshold":0.9},"id":"CVE-2026-55688-196c41e3","signature_type":"Line","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841","target":{"file":"client/src/main/java/org/asynchttpclient/netty/request/body/NettyByteBufBody.java"},"deprecated":false},{"target":{"file":"client/src/main/java/org/asynchttpclient/netty/channel/ChannelManager.java"},"deprecated":false,"digest":{"line_hashes":["30387104020841064882001778204474212222","12668499004021422738884031629684437480","323376399883849058076283062316441365177","182974986772885460164015591309792566570","40055171979285218887616861524842569091","152243798662650721123474849844260069174","300171396396576497607094817614662512937","137075780703861729422623027693387942380","26391102038949804322075822929420572224","203890281723701381215341918921436854303","207914708018679425204217618907303113003","203888250600956396938725301008172121898","55389601495400597277244868498036809545","157734109042204311654643789764732395284","27572453550939595642716214616775206473","44716018448471596964521692241634999107","163903292257579748773166496628820359112","284335186230950740508886841132360202993","106805832610637182014083194920571863882","132543267269006944837788834708118679709","31288899329313873179287531982671508602","113195104897998115666121984855156554863","147719988716123521854913398170595050376","173253908659046786200185532242727345409","308481199433183374443119793301376030360","53497044420723775521156741768727640704","267830811371516781298827716936616445644","300416954753418904481266580044919455835","75184923541567514448972435340877359851","323559123544074482199205754868945477655","241751153729464819547645949918936870867","201424870153828401403498758751119414587","326863058870020238480507581343369821081","19773588267085927550518046533532815736","211454256670965128911327767055538852261","138749734233103715698554388838273512927","131109859723492007755513339960627611039","64297089482167897594550660318799377499","67837271545297122567906410664952105780","167273743486226684720184606242833823258","269706618946317496940019230930227355071","118086504969977785027497946243631643679"],"threshold":0.9},"id":"CVE-2026-55688-19dbe7da","signature_type":"Line","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841"},{"signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841","target":{"file":"client/src/main/java/org/asynchttpclient/netty/handler/Http2Handler.java","function":"finishUpdate"},"deprecated":false,"digest":{"function_hash":"116140448022794800141090635778853099912","length":733},"id":"CVE-2026-55688-1d51e100","signature_type":"Function"},{"id":"CVE-2026-55688-208b8b36","signature_type":"Function","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841","target":{"file":"client/src/main/java/org/asynchttpclient/netty/request/body/NettyFileBody.java","function":"writeHttp2"},"deprecated":false,"digest":{"function_hash":"271894221060082503565533345385317254824","length":605}},{"deprecated":false,"digest":{"function_hash":"275674064103793596354852831996366480838","length":69},"id":"CVE-2026-55688-35550802","signature_type":"Function","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841","target":{"file":"client/src/main/java/org/asynchttpclient/netty/ssl/DefaultSslEngineFactory.java","function":"destroy"}},{"id":"CVE-2026-55688-36b20b10","signature_type":"Line","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841","target":{"file":"client/src/main/java/org/asynchttpclient/netty/channel/NettyConnectListener.java"},"deprecated":false,"digest":{"line_hashes":["23499922274628029249708441184748639894","242629825859646686624600689169833262073","164056084286574539867358777117753210819","271204716706183541073201619006865142767","63782250107979814339657066159036833186","35323813022816800573358915457953712470","293310067559342945337884239780677034561","35463585654461201264951653831021873919","202507809385195696899643867705494033822"],"threshold":0.9}},{"deprecated":false,"digest":{"function_hash":"62134210931991528266995397700680488304","length":453},"id":"CVE-2026-55688-39251935","signature_type":"Function","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841","target":{"file":"client/src/main/java/org/asynchttpclient/netty/channel/ChannelManager.java","function":"registerHttp2Connection"}},{"source":"https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841","target":{"file":"client/src/main/java/org/asynchttpclient/AsyncHttpClientConfig.java"},"deprecated":false,"digest":{"line_hashes":["65514355774884786596166886907006677558","92237267947547220853754716769339477193","113904975625080614497739738539041195842"],"threshold":0.9},"id":"CVE-2026-55688-3a64d652","signature_type":"Line","signature_version":"v1"},{"digest":{"length":1381,"function_hash":"107223354646639030966220716861755217121"},"id":"CVE-2026-55688-3a690f30","signature_type":"Function","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841","target":{"file":"client/src/main/java/org/asynchttpclient/netty/handler/Http2ContentDecompressor.java","function":"channelRead"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841","target":{"file":"client/src/main/java/org/asynchttpclient/netty/channel/ChannelManager.java","function":"channelRead"},"deprecated":false,"digest":{"function_hash":"29262025889899362940984181399984401602","length":663},"id":"CVE-2026-55688-3eafebb9"},{"signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841","target":{"file":"client/src/main/java/org/asynchttpclient/netty/handler/Http2Handler.java"},"deprecated":false,"digest":{"line_hashes":["331420566744053957333700151936609490516","172908099278555920287383350121870039610","204403288090289922930835821291126756762","299120130318513276035765519920054186589","22210761941359419526072853066046015239","40195187519526841299905752981857343691","187042589468553246671591464849039551993","121537253180954534583755708686100880422","210161652503588362051299215919973371565","213942316784240751628743045320773426466","328872615763461957293605179439451842916","275114377191418575894409610634402619047","324742325186772323858961173242143212662","128253365039529711112337935966076832649","99982950036736928505828362736057134308","272914591891822720408691685594581397894","82820148192626586175376501729509909297","331863260025877289096634620880446436479","161888342602280032988081820913766372025","13598574962394888815310333763461376110","276791764247077884598335992525211194956","249621355926232301335824388780276145042","66159217237331809296461531240523641006","259605536103992416080480072383959409312","233403252646901134146420527399456437252","199664187969668648995955416662005014745","263507763031456120101037369714001956115","135367410001120105491179319981031475136","263790351756826580002210128074404297526","87920190326234021607711196873582135156","258571140505852165431853619700550475172","96688490052737482050865671548390071961","12638854611943742434836417397840492526","254445378337222594665903793433362791128","336372340702314468676608540375058545050","175296242479120512798802895177490827563","251204868730290356311175285148218474928","323022789488561865276913126606560261741","111561699803785005183398276490488135544","26763098645125250874257271515038233827","274441805055325308306994114543642816711","210735214142527992415751662419442269479","181967710510849916724946580214627648442","321740245126393100629073083812589339027","283085079909249862094810433503972100195","265519583346637777181634882398478723638","135921941510739264463729185044723093246","8236251418872552143243413469570562921","312395617489134079876207300617752271841","164778276513695769331039067968923988625","3656602936512943670219118833402273254","282986450170246514544336002761482838834","10491779843739574951867755388110533828","78197176440871400854394920731693555682","271733600446492949377041053783317932057","72767972669176411155723167712317929079","168790186836677457107862705071216027202","6400593176737285015285305087006250998","71686375905391617280977266467612139193","253266921858392035763631401309454706","42319695417763052543471199088391901649","147677714870184613821365853307681871985","57383178451509262401631799651005834377","66226398544360526860303599424549720324","261642277360173620807265763074375440254","133361669883240955540691910880710534216","165938058828127821941288858541315497393","111055398415940251326156426170214857036","169690680049066928281353092282071908586","1205959798521751159354129434213395345","96703308281564332601244130088514008607","321951856222181648061925505034209076340","83923270324275790776177234421338945294","181491998066711094553921293099613562136","90353017723780946529288450447877298189","160875111172549089442548863226362374988","284380021583096358995631701243807592850","37866020084531473303668228810875086900","112328211606016515887604772158007898633","18114830952942327973296676555535938317","299816070478351474253289796724338866881","274045158407530882937016836974570367565","326196488866761082224298665690526882694","287855594216154706363058924581433348667","204109771800292452668686454357203323549","231877598785702182126053318446241192411"],"threshold":0.9},"id":"CVE-2026-55688-40a288fb","signature_type":"Line"},{"source":"https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841","target":{"file":"client/src/main/java/org/asynchttpclient/netty/ssl/DefaultSslEngineFactory.java","function":"buildSslContext"},"deprecated":false,"digest":{"function_hash":"171407218849963972580305150638791810878","length":1110},"id":"CVE-2026-55688-40b6d065","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/asynchttpclient/async-http-client/commit/8e4069cf3c92abe099db5fb13378ac2fe9e1fd3b","target":{"file":"client/src/test/java/org/asynchttpclient/CookieStoreTest.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["158694078049405266416936617745272244885","171135242912738179266975243258241950028","80672101766945575573065386917627806633","178874045802535394242559641107901208251","329177339630615529659516686781782560849","14462809932617956612360595160714261880","63673591984520693134057432017329118878"]},"id":"CVE-2026-55688-4444dbc3","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841","target":{"file":"client/src/main/java/org/asynchttpclient/netty/channel/Http2ConnectionState.java","function":"addPendingOpener"},"deprecated":false,"digest":{"function_hash":"187591754750909286346038167362963481133","length":200},"id":"CVE-2026-55688-46d4d555","signature_type":"Function"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841","target":{"file":"client/src/main/java/org/asynchttpclient/SslEngineFactory.java"},"deprecated":false,"digest":{"line_hashes":["47030553866274257733845357714686287567","337936671732551968771661954460168101164","261755117747922094816723719857411135746"],"threshold":0.9},"id":"CVE-2026-55688-4a0f2b79"},{"deprecated":false,"digest":{"function_hash":"197865424274849202373734750738025001715","length":1421},"id":"CVE-2026-55688-55476495","signature_type":"Function","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841","target":{"file":"client/src/main/java/org/asynchttpclient/netty/request/NettyRequestSender.java","function":"sendHttp2Frames"}},{"target":{"function":"replayRequest","file":"client/src/main/java/org/asynchttpclient/netty/request/NettyRequestSender.java"},"deprecated":false,"digest":{"length":528,"function_hash":"138863181786070727138819902544997728283"},"id":"CVE-2026-55688-56f8711d","signature_type":"Function","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841"},{"digest":{"function_hash":"112355423577261647750594299033178337314","length":164},"id":"CVE-2026-55688-5b22566a","signature_type":"Function","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841","target":{"file":"client/src/main/java/org/asynchttpclient/netty/NettyResponseFuture.java","function":"terminateAndExit"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["218749333867074229323244942630791484244","73185341731785929753638125403726501648","15283995770994737244021730660571898221","45016011273002945303459210625814929336","254056173230260832411622882832341344682","169267155448077540245293946248312309150","335890207982397433623437939547914188796","149320191733992689214235522110139875773"],"threshold":0.9},"id":"CVE-2026-55688-60038bf0","signature_type":"Line","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841","target":{"file":"client/src/main/java/org/asynchttpclient/netty/request/NettyRequest.java"}},{"deprecated":false,"digest":{"function_hash":"329082949233564416226119730793375327272","length":3397},"id":"CVE-2026-55688-60edc56a","signature_type":"Function","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841","target":{"file":"client/src/main/java/org/asynchttpclient/netty/channel/NettyConnectListener.java","function":"onSuccess"}},{"source":"https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841","target":{"file":"client/src/main/java/org/asynchttpclient/netty/request/NettyRequestSender.java","function":"writeRequest"},"deprecated":false,"digest":{"function_hash":"63169110221114494456355467625833112187","length":1173},"id":"CVE-2026-55688-631a3ea8","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841","target":{"file":"client/src/main/java/org/asynchttpclient/netty/request/body/NettyFileBody.java"},"deprecated":false,"digest":{"line_hashes":["43234481567836024354982964593009412583","106926726704586526797830498738079180838","103699109810858269306262352698377166334","49568881603497354439195487917353570102","304405860611796965125883930351264563394","79352675734159107548374137752281591861","52007657951139366207821688184676818340","212898588932452547909587829389745076714","334700775958751972638922092179472083528","34326878805288320380613891915263213164","89699450437747646431818322223450139699","199146600752441980623400094240646025482","338457943196944953178878972532077470499","177034105801730586818708960815120907586","226782367654192064923589983411434275103","59975153372591601826038623723763037452","238992659687193156296731477363015188293","304140352000694679253443591536122307788","186302725698027929136435460471796886077","184268107055853823967755429207662669737","177087033745066094537233351839267987123","329365707142571374793624336132294694462","204773980137262831373989017037581499739","34475393087969777365987435919213678807","230638529051984127253107946194582826123","169675414726816804530549398270080412397","108412739631672893142853127786287850013","260346270132000266114162419174526842916","263868593844087527307990423928178287852","92349052548863752660197021101077700970","336674137555455975798072033562033366762","18747295951711707560918935415607112657","180771468269998263266350932322240468207"],"threshold":0.9},"id":"CVE-2026-55688-69a60dcf","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2026-55688-722252f0","signature_type":"Function","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841","target":{"file":"client/src/main/java/org/asynchttpclient/netty/handler/Http2Handler.java","function":"handleHttp2GoAwayFrame"},"deprecated":false,"digest":{"length":726,"function_hash":"166683599770149753714482319578308494343"}},{"target":{"function":"byteBuf","file":"client/src/main/java/org/asynchttpclient/netty/request/body/NettyByteBufBody.java"},"deprecated":false,"digest":{"function_hash":"222486790472277647262725066761723456455","length":34},"id":"CVE-2026-55688-73637417","signature_type":"Function","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841"},{"id":"CVE-2026-55688-761aded3","signature_type":"Function","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841","target":{"file":"client/src/main/java/org/asynchttpclient/netty/channel/ChannelManager.java","function":"upgradePipelineToHttp2"},"deprecated":false,"digest":{"function_hash":"167368227436023272784031870133224998352","length":2938}},{"source":"https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841","target":{"file":"client/src/main/java/org/asynchttpclient/netty/handler/intercept/Continue100Interceptor.java"},"deprecated":false,"digest":{"line_hashes":["238488509598723669886965221710324415265","33513890791641622038294298341188533263","23421816313708723441256155081640002005","188528807130293954447079886940457633685","57225978491809188686291322922614429403","86594882120978413614309525363317485280","132117635214832278560476572058150705875","247607905697590598089858295074676108049"],"threshold":0.9},"id":"CVE-2026-55688-76a1beac","signature_type":"Line","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/8e4069cf3c92abe099db5fb13378ac2fe9e1fd3b","target":{"file":"client/src/main/java/org/asynchttpclient/cookie/ThreadSafeCookieStore.java"},"deprecated":false,"digest":{"line_hashes":["213105997135152581652968871498355794991","10212155504525293776912577917305845336","12055171428288684154746124412619865672","73337062200638342948222412190087136537","53616234612576811078396385320379538850","279213141767620651758839923362383040273","169528175273420128919069556898530255284"],"threshold":0.9},"id":"CVE-2026-55688-77fb64cd"},{"deprecated":false,"digest":{"line_hashes":["302936636447435158194391065056668651861","235383983289592658209175924648113956068","193257605427120266049235920493560141376","158559275522236753205798642233556734687","48517308577934852841711849473363075497","266006314506856806421845306519835919802","242128824826815097089724170022570558046"],"threshold":0.9},"id":"CVE-2026-55688-78cc73e9","signature_type":"Line","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841","target":{"file":"client/src/main/java/org/asynchttpclient/config/AsyncHttpClientConfigDefaults.java"}},{"deprecated":false,"digest":{"function_hash":"38930259353658025811737418076055003795","length":3642},"id":"CVE-2026-55688-7c43cbfe","signature_type":"Function","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841","target":{"file":"client/src/main/java/org/asynchttpclient/DefaultAsyncHttpClientConfig.java","function":"DefaultAsyncHttpClientConfig"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841","target":{"file":"client/src/test/java/org/asynchttpclient/netty/channel/Http2ConnectionStateTest.java"},"deprecated":false,"digest":{"line_hashes":["152536460709786297217477216436219884632","316953234518142422382571033535226096024","221669867940264415062960617283922098067","8777889931199012878636135424809568587","230568940715260754825173628237455802946","232631314251032700592408790673940850043","124294884952525780967922658264442800311","47662802032278731534011784110877745664","267726936926692496970479416272209400135","61983421264997182432503364475873229309","283527052124018485654681881085888405566","70633997864646297367083755602503146802"],"threshold":0.9},"id":"CVE-2026-55688-7f57796b"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/8e4069cf3c92abe099db5fb13378ac2fe9e1fd3b","target":{"file":"client/src/main/java/org/asynchttpclient/cookie/ThreadSafeCookieStore.java","function":"add"},"deprecated":false,"digest":{"length":629,"function_hash":"152155023182119484639324774900451504434"},"id":"CVE-2026-55688-81555d1a"},{"target":{"file":"client/src/main/java/org/asynchttpclient/netty/request/NettyRequestSender.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["119438064821204654527666649248050150065","328722048546505302948152496876179917883","268057102184108587579378557141457668311","64827448314790781292590797081325685822","41350140154874667804192723212534962118","265889736200413525914262829601606835972","263205685604113117441683520472033259600","260198884774265558986925309967764129004","253131997496848017946137665911012374330","114792842660887897915864266532500638140","101031112135952466817999097772340825970","138117599714847111901526776892972410068","22558284444522201235079307786194655974","225141374320266377895636359298927146057","212531447601761163630482216181422748885","174582711957234839280158076217416073893","77119017413531946453999642114890287042","117891111654773154578913123709743242627","126315694668231985055390076639009071996","17797079410239809468692490146152490971","194659921297205753202857660027825427279","287270733906301624515036951047601142973","84751998937269858891062071490659352642","127425476045057162049527869470355510321","217274093369932740370049880536591652535","333877690146389071158799956899381008898","322211877141011197746788659147198190785","218535501318121854924102623797542974891","109350697984883551123052990286479965207","329810287938724830529556016226017313113","316655672894079057978818822929500369330","160322489007861403179407675151234899331","233854164788666339457796793697441253769","152515983681803672134917444568264428888","83610187721576132085794535543123361834","88535203818143263222585216836005944972","78727551835126382735215580687790308066","8160598211745673789442787982319417235","140399567649889734699934598002559531000","165445541286325090999973180153715065505","193359388028822315689935103790429025678","215267328122295418973128274661678810554","67415210526953518110762410921559385838","115076125944813892498984083265954674182","76206956581384963918567199616939193788","323148810888511038706390055939107850721","320014996965433968187636579928702117955","104878824886945060295906440718212221810","21319698604801956487012143921397624660","183550410269421174430782407159474084424","214003308012987977612766041557308660047","103912147359821341690436186232832358501","53434846878988809120472197087841579931","18464479813929328347254840671184630392","246837877891897133430343883014399797707","28427204224473637243074491978836454122","249864750869477197945035250112258159485","278034970308112471479559708214328084909","64290222686710358127826548633299449775","53943899456994187335085210604781301749","186231181252230110201330992854339878626","193758914859295163360222098988348470608","54485919864780511360620876498885010462","37916261028138988206031848771081828593","329663999712491363884140171302047788807","136615643943171052074471351131508271035","272979133563838663822667065511600585229","254057645057765213456592858568060093933","312149842907834952296704992922108441828","247405022949703356732840169453871723213","159358151100504114368697421753941451086","234843377578913068413002978608026392906","271421210173194427491627102594390974105","167914451854597759254808418980242477373","56563442844604040667369838556717623685","175942152726326671577483304448899154236","274611908366911172321232217380882307057","106300900141301255667116023987752688451","43952656746146667528571662813971245721","95030952540972880986327889840330919308","78958662060145784505842811204724019858","161020830748497431117891169703836163440","44936002785290566543620339227304770365","185829317418361117631687956664160727685","53687472147514557973277878893419415512","336898015029734688639444097305688192885","270465106146820704298572222839963078193","117928808956263186476686617431228296828","223309730575705323857706399252871873214","43531793306695634077137719646516863388","46332837857357047214276399329821886410","68277911454634018011170046462887321252","269128677273640212386780612120814103474","287250289630927934608562093511368749155","155618589147297644052450498991858903127","20428005903588097098685906001452302152","274609612330602945186971393754903323007","210490949247195093303971834520135466309","156997295985406667224646053232742923588","325635478339527807332616613181117296378","228031060324608349883453185535983386942","85563517347429217284341669234971986245","177967773986800779072950689029184005846","334103427562097124528718158897849811220","134380095233647964553203460944895933995","259724774940983901995622325634918586481","61025083897568171931463998608185095356","244197461709863595090417320005081324545","157575214813254339221158132103101326585","173461583142720571125306706136920034676","245837367218127451674185382723069448861","196696198018771358768409457672477368111","247232625726992285446261226510445607546","155526068976230444869076891726773769221","229578786116513567594204845181228971862","202606261617367563307231778594065014610","68700956244922154674275309168636290655","6026176318056230065158563020927246265","207397979671457024932177085403761644426"]},"id":"CVE-2026-55688-81897264","signature_type":"Line","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841"},{"target":{"function":"handleHttp2HeadersFrame","file":"client/src/main/java/org/asynchttpclient/netty/handler/Http2Handler.java"},"deprecated":false,"digest":{"function_hash":"17530926016445692667262961388555296545","length":996},"id":"CVE-2026-55688-827df6ce","signature_type":"Function","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841"},{"target":{"function":"build","file":"client/src/main/java/org/asynchttpclient/DefaultAsyncHttpClientConfig.java"},"deprecated":false,"digest":{"length":2216,"function_hash":"254694623578577446641236813949157593445"},"id":"CVE-2026-55688-845014f7","signature_type":"Function","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841"},{"digest":{"function_hash":"324723830007739038815144036255536192815","length":936},"id":"CVE-2026-55688-8f9a8cf2","signature_type":"Function","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841","target":{"file":"client/src/main/java/org/asynchttpclient/netty/channel/ChannelManager.java","function":"updatePipelineForHttpTunneling"},"deprecated":false},{"digest":{"length":343,"function_hash":"239085649823358910813012296282530369024"},"id":"CVE-2026-55688-94e793a7","signature_type":"Function","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841","target":{"file":"client/src/test/java/org/asynchttpclient/netty/channel/Http2ConnectionStateTest.java","function":"addPendingOpenerWithZeroMaxConcurrentStreams"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"129859699811618843167518732807283790682","length":276},"id":"CVE-2026-55688-988a559d","signature_type":"Function","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841","target":{"file":"client/src/main/java/org/asynchttpclient/netty/ssl/DefaultSslEngineFactory.java","function":"newSslEngine"}},{"id":"CVE-2026-55688-9de62cc4","signature_type":"Function","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841","target":{"file":"client/src/main/java/org/asynchttpclient/netty/handler/intercept/Continue100Interceptor.java","function":"exitAfterHandling100"},"deprecated":false,"digest":{"length":401,"function_hash":"63911647829183348703923769887667119129"}},{"source":"https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841","target":{"file":"client/src/main/java/org/asynchttpclient/netty/handler/Http2ContentDecompressor.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["253422009867771741918093294709443833936","21823556881918565729831316557690834190","200807070865387167329899158582355530211","165951157430060453609037063044464607822","243127565938855314629738460503586151779","38835864937427346434533419328346853548","211789229652080103893353352083681008055","211067571629286156262130661096154535348","169310331670907405300840003790325221546","246639459092083642337991774981336596908","262679696952574109914938962206240482992","155148766672275100170456853453053660701","66046542311741880596972445930701284355","339082823805500458195741288441200911285","75248862280756031098874135983234445238","195232628741288589062892926807167966964","87747181538119790827383794160318422298","58841950790330435721641527376671538677","58168414281291645047490332995332673751","192873722977191570932497273243623663648","316535605510127456067009711310198821746","3064464792799282636408746569122547800","151474661781890787207750511101211261279","60109057056103409219527658969925764716","289892182041330419924468107516807711875","339288572711192168998065562184850838077","175780009799240366521037586091420213299","98120590039491953231827780252070805152","124008729645157600096239573939786842830","206515462241069020336375013000402286187","302621602174065596021559585423071172169","47266374533292383957814598069560777856","221154439922329394869962360984488418110","138001601219251756982146144665480302945","295789269858419382702875547651710169817","149086078507665974006138624656466071812","67230770949975033532988540061836866594","68369968455449780043405025814676222215"]},"id":"CVE-2026-55688-a0855412","signature_type":"Line","signature_version":"v1"},{"digest":{"function_hash":"54814579453029277298933290366087221144","length":860},"id":"CVE-2026-55688-a53f59fd","signature_type":"Function","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841","target":{"function":"writeHttp2","file":"client/src/main/java/org/asynchttpclient/netty/request/body/NettyInputStreamBody.java"},"deprecated":false},{"digest":{"function_hash":"316572681897388022559735775415777991421","length":221},"id":"CVE-2026-55688-aa1c2dec","signature_type":"Function","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841","target":{"file":"client/src/main/java/org/asynchttpclient/netty/channel/Http2ConnectionState.java","function":"drainPendingOpeners"},"deprecated":false},{"digest":{"function_hash":"142941273132518517777387412915863503092","length":916},"id":"CVE-2026-55688-adeba581","signature_type":"Function","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841","target":{"file":"client/src/main/java/org/asynchttpclient/netty/channel/ChannelManager.java","function":"updatePipelineForHttpsTunneling"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841","target":{"file":"client/src/main/java/org/asynchttpclient/netty/request/NettyRequestSender.java","function":"initChannel"},"deprecated":false,"digest":{"function_hash":"152627523885473382999297957106370734959","length":235},"id":"CVE-2026-55688-b0ba7eb5","signature_type":"Function"},{"digest":{"threshold":0.9,"line_hashes":["301956855787272313753580825010319499108","19240583457449598116401706929992483141","133327520452860534552884835513553529050","309749709202644576849103901163942077183","254328589927841818785202250926674449083","111637756446063258543527580174167768335","335775442849151416221020333576273558609","241857995198919394582963049324970961854","55421975553662860988155879425029351610","7015216382716676276731735401406984845","79077843914300977820377858763364321024"]},"id":"CVE-2026-55688-b3d822c4","signature_type":"Line","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841","target":{"file":"client/src/main/java/org/asynchttpclient/netty/NettyResponseFuture.java"},"deprecated":false},{"target":{"file":"client/src/test/java/org/asynchttpclient/CookieStoreTest.java","function":"runAllSequentiallyBecauseNotThreadSafe"},"deprecated":false,"digest":{"function_hash":"1775486200237590426810480674372578884","length":504},"id":"CVE-2026-55688-b4139664","signature_type":"Function","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/8e4069cf3c92abe099db5fb13378ac2fe9e1fd3b"},{"signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841","target":{"file":"client/src/main/java/org/asynchttpclient/netty/handler/Http2Handler.java","function":"handleRead"},"deprecated":false,"digest":{"function_hash":"70024375161957820048956679583532554155","length":884},"id":"CVE-2026-55688-b8f901f7","signature_type":"Function"},{"source":"https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841","target":{"file":"client/src/main/java/org/asynchttpclient/netty/request/NettyRequestSender.java","function":"releaseHttp2Stream"},"deprecated":false,"digest":{"length":82,"function_hash":"170173469990056151281867852755957495536"},"id":"CVE-2026-55688-bc4f4f0c","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"288652667548671541065932174382739117124","length":88},"id":"CVE-2026-55688-be86fbf3","signature_type":"Function","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841","target":{"file":"client/src/main/java/org/asynchttpclient/netty/ssl/DefaultSslEngineFactory.java","function":"init"}},{"deprecated":false,"digest":{"function_hash":"39901452766423235777448641038065482715","length":622},"id":"CVE-2026-55688-c8c2aef3","signature_type":"Function","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841","target":{"file":"client/src/main/java/org/asynchttpclient/netty/channel/ChannelManager.java","function":"addSslHandler"}},{"source":"https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841","target":{"file":"client/src/main/java/org/asynchttpclient/netty/request/NettyRequestSender.java","function":"writeHttp2Request"},"deprecated":false,"digest":{"function_hash":"42602855601569067265204874083358817992","length":601},"id":"CVE-2026-55688-cbcd491c","signature_type":"Function","signature_version":"v1"},{"target":{"file":"client/src/main/java/org/asynchttpclient/netty/request/NettyRequestSender.java","function":"waitForHttp2Connection"},"deprecated":false,"digest":{"function_hash":"324043190269569083770660756981605951548","length":495},"id":"CVE-2026-55688-d18d91f3","signature_type":"Function","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841","target":{"file":"client/src/main/java/org/asynchttpclient/netty/NettyResponseFuture.java","function":"cancel"},"deprecated":false,"digest":{"function_hash":"229807173759111656597472345573061885477","length":477},"id":"CVE-2026-55688-d1c4a34c"},{"target":{"file":"client/src/main/java/org/asynchttpclient/netty/request/NettyRequestSender.java","function":"pollPooledChannel"},"deprecated":false,"digest":{"function_hash":"219998368357020436009026373290079535152","length":719},"id":"CVE-2026-55688-d7bd175c","signature_type":"Function","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841"},{"target":{"file":"client/src/main/java/org/asynchttpclient/netty/channel/ChannelManager.java","function":"createSslHandler"},"deprecated":false,"digest":{"function_hash":"98255007670129542502283808907247912474","length":232},"id":"CVE-2026-55688-db9cce9b","signature_type":"Function","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841"},{"target":{"function":"Builder","file":"client/src/main/java/org/asynchttpclient/DefaultAsyncHttpClientConfig.java"},"deprecated":false,"digest":{"function_hash":"1048225234699166753492691210653490726","length":3817},"id":"CVE-2026-55688-e70b2fd3","signature_type":"Function","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841"},{"signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841","target":{"file":"client/src/main/java/org/asynchttpclient/netty/channel/Http2ConnectionState.java","function":"addPendingOpener"},"deprecated":false,"digest":{"function_hash":"318796423508470015881391960860577824919","length":62},"id":"CVE-2026-55688-ea428bdc","signature_type":"Function"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841","target":{"file":"client/src/main/java/org/asynchttpclient/netty/channel/NettyConnectListener.java","function":"onSuccess"},"deprecated":false,"digest":{"function_hash":"291197188114682477072989390359047633747","length":553},"id":"CVE-2026-55688-eac5118e"},{"deprecated":false,"digest":{"function_hash":"87527761563858618585315895094570393172","length":1323},"id":"CVE-2026-55688-ec30e9ee","signature_type":"Function","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841","target":{"file":"client/src/main/java/org/asynchttpclient/netty/request/NettyRequestSender.java","function":"openHttp2Stream"}},{"signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841","target":{"file":"client/src/main/java/org/asynchttpclient/netty/request/body/NettyBodyBody.java"},"deprecated":false,"digest":{"line_hashes":["242250493679994314132694752406105459307","119478040034929904717843503902460816388","134348603463405165225569330065034686670","36524855504918587287391462379405395736","256395054393637088652297237964623648759","14229652230387917115241520886688258517","332877131765482460919564483971894765120","260319728483325690824025371090946294132","8167729403037745019186362661089878501","257297274013576164714634988435135976347","253407561940985876446532740106402830534","199410922507438605582281666571063367288","291204513207153732611749490711907003754","20671782582284635004328740780755218269","110461150340920749659314545303103296593","55985511606641729878256585685362477762","54646837197637628045059791542566127217","84421815256311749364751293628735357013","83372978786303156660319921499613743506","113586248847039417863105624086960614933","69965282108464580908061753219337873924","67484021554374919861489293245263843562","319712838391457202285641501114116732937","310585742961085316226268993131730799555","333596523726751583092974974276987955891","163360916862037725224150841418183737057","333261012389667240517260951996705560582","255069459670660148643073613385987983820","336421145927775472855118539803013243531","26425960058003503354921305046070411298","271480802128666347613602299773792263838","282162907031755965003701304198866918480","321445303095118471638049737102555304056","113094582079558898811707381134018087884"],"threshold":0.9},"id":"CVE-2026-55688-f3006aaf","signature_type":"Line"},{"id":"CVE-2026-55688-f7b6ebae","signature_type":"Line","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841","target":{"file":"client/src/main/java/org/asynchttpclient/DefaultAsyncHttpClientConfig.java"},"deprecated":false,"digest":{"line_hashes":["37250148668781893677688852929490888031","42098258760845732861766939510360532657","293130276324970969182322825045917988399","249633957414014333654688369007814237463","10903647880959350635494872478899053602","217428166570322993561246166815820862930","281887064532740482514682474578539972637","151187886217374951065560215844126881229","208970667120066448979844198812379191795","190244808777808447776356142052708072672","23379863734576051468674882829166571023","292549917881359499085149703090944212235","308366662141558085355636832217359656496","78523267059901985938118301976824511901","241326004984977145611949860150287939028","105527658509263737787957823895956059284","252028528647425681805081087028629831649","86336583982701730651915806443604139920","42518029648170234868300853863883265845","40208564239498955381532483065730671989","247280657930761878727002856196116257559","244437857368844994313036078736894823810","187949788422487424378327764871688877180","209466043887905190467404193479573404028","285259223941689873344203193148983235856","302039803057849461859252627234002334743","273339601731315771290926167779292877819","330715845156034643597392718056633634241","317399691561048635243271890034540857007","92558811722547489860321439142210258693","184851907581933507553491923267536570603","207671729032803956052331912002697454346","269335363957515505815673079136712787359","54538496145409531116437717841046188880"],"threshold":0.9}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841","target":{"file":"client/src/test/java/org/asynchttpclient/DefaultAsyncHttpClientConfigTest.java"},"deprecated":false,"digest":{"line_hashes":["100970644375370328899885056450758667511","180439485623435604290249790799564375231","298841151830067496670890058923806360760","72248671791205910254230015458684166070","257309318297310539071462747291560736103"],"threshold":0.9},"id":"CVE-2026-55688-f832f001"},{"id":"CVE-2026-55688-fa060a1c","signature_type":"Function","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841","target":{"file":"client/src/main/java/org/asynchttpclient/netty/handler/Http2Handler.java","function":"readFailed"},"deprecated":false,"digest":{"function_hash":"330386850907958684717680561596712079894","length":266}},{"target":{"file":"client/src/main/java/org/asynchttpclient/netty/ssl/DefaultSslEngineFactory.java"},"deprecated":false,"digest":{"line_hashes":["23865423823363754034163865227376553843","215383280142682198418852671107549614262","102616635088237724777698295441891774250","269507508914457197269750259759715682741","101714192232686759652488249851858843481","110900903761915517866512062627766998608","66362429832025525452751707074776091099","7965956526857806343016503713005375191","144688183678202265393994641819552934285","315027646457470740358482568931506958507","280169964249986877904898185982462269823","119289809656091413247904919996273636586","69003393923374637911735495586450954452","211309652618387707994569009849304050631","337107302786167809913407777581623019881","125553194831521486899570060042649537980","316575594660311788417519386797171987314","265346628001407167235551950345346044845","240831370177200269586611551038792811562","274908733958785329381987616772287683268","153632845636662769877008781333209418672","191338669696224725866968342614165153701","168225709066580610550332634304688394600","270123742940097343444166728583878790302","239970747944344907923037604010986513193","163187130037832030526419100395422458566","50176559341104836066420955951948399308","251076775898200296861632456772986055299","133817562732839592135290090927671815116","240294242952314574952125481508006254561","120173941925802665893915990413613000487","102140373605288975912096374265895059829"],"threshold":0.9},"id":"CVE-2026-55688-fbcc9fa7","signature_type":"Line","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N"}]}