Session Fixation and Cookie Security Flaw in AsyncHttpClient Library
Summary
DEBIAN-CVE-2026-107226: The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Affects async-http-client versions 2.12.3-1 – 2.12.3-1+deb12u1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The AsyncHttpClient (AHC) library is a widely used Java library that simplifies the process of executing HTTP requests and handling HTTP responses asynchronously. It is designed for high performance and scalability, making it a popular choice among developers for building web applications. However, a critical vulnerability has been identified in versions 2.1.0 to 3.0.14, where the default ThreadSafeCookieStore fails to properly manage secure cookies, leading to potential security risks.
Vulnerability Detail
The vulnerability arises from the default ThreadSafeCookieStore in AsyncHttpClient, which does not retain the secure transport status of Set-Cookie responses. This flaw allows secure cookies to be accepted over plaintext connections, enabling attackers to manipulate cookie states. Specifically, an attacker can plant, replace, or remove cookies sent to an HTTPS origin, leading to session fixation, CSRF-token replacement, or loss of security-relevant state. The issue has been assigned a CVSS score of 6.8, indicating a medium severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider implementing additional security measures such as validating cookie attributes and enforcing secure transport for all cookie exchanges. This can be done by configuring your application to reject cookies that do not meet security criteria.
Conclusion
The vulnerability in the AsyncHttpClient library poses significant risks to web applications by compromising cookie security. It is crucial for developers to update to the patched version 3.0.14 to mitigate these risks and ensure the integrity of user sessions. Utilizing tools like Vulert can further enhance security monitoring.
See every vulnerability recorded for async-http-client →
FAQ
Versions 2.1.0 to 3.0.14 of AsyncHttpClient are affected by this vulnerability.
The risks include session fixation, CSRF-token replacement, and loss of security-relevant state, which can compromise user sessions and application integrity.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Yes, the vulnerability has been patched in version 3.0.14 of AsyncHttpClient. It is recommended to update to this version.
Vulert monitors and alerts in real-time for open-source vulnerabilities in software using a manifest file like package-lock.json, allowing developers to stay informed about potential risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for async-http-client.
