CVE-2024-53990: AsyncHttpClient CookieStore Vulnerability Leading to User Cookie Overwrites
Summary
CVE-2024-53990: AsyncHttpClient (AHC) library's CookieStore replaces explicitly defined Cookies. Affects org.asynchttpclient:async-http-client across 2 version ranges.
>= 2.1.0, < 2.12.4
>= 3.0.0.Beta1, < 3.0.1
Fixed in 2.12.4 or 3.0.1, depending on the release line you run. How to fix ↓
Also tracked for
- async-http-client · Debian:11
The same CVE-2024-53990 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
AsyncHttpClient (AHC) is a popular Java library designed for asynchronous HTTP requests, enabling developers to build high-performance applications that require non-blocking I/O operations. The library features a self-managed CookieStore, which automatically handles cookies for HTTP requests. However, this functionality can lead to significant security issues when multiple users' cookies are inadvertently mixed, compromising user data and authentication.
Vulnerability Detail
The vulnerability arises from the CookieStore's behavior of replacing explicitly defined cookies with those from the cookie jar if they share the same name. This can lead to a scenario where one user's cookie is used for another user's requests, potentially exposing sensitive information and allowing unauthorized access to user accounts. The issue is particularly critical for backend services that implement third-party authentication, as it can disrupt the integrity of user sessions and lead to data leaks.
How To Fix
Latest published version: 3.0.14 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.1.0, < 2.12.42.12.4 -
>= 3.0.0.Beta1, < 3.0.13.0.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, developers can manually manage cookies by avoiding the use of the default CookieStore. Instead, explicitly handle cookies in their application logic to ensure that user-specific cookies are not overwritten. This can be done by creating a custom CookieStore implementation that does not replace cookies based on name.
Conclusion
The AsyncHttpClient library's vulnerability (CVE-2024-53990) poses a significant risk to applications that manage user sessions through cookies. By updating to the patched version or implementing a custom CookieStore, developers can mitigate the risks associated with this vulnerability and protect user data.
See every vulnerability recorded for org.asynchttpclient:async-http-client →
FAQ
CVE-2024-53990 is a vulnerability in the AsyncHttpClient library that allows cookies from one user to overwrite those of another user, potentially leading to unauthorized access.
If your application uses AsyncHttpClient and handles multiple users, this vulnerability can lead to serious security issues, including data exposure and session hijacking.
If you cannot update, implement a custom CookieStore to manage cookies manually and prevent overwriting of user-specific cookies.
More information can be found on the GitHub issue page and the pull request that addresses this vulnerability.
Vulert allows you to monitor and alert for open-source vulnerabilities in your software using just the pom.xml file. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.asynchttpclient:async-http-client.
