DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-55688: CVE-2026-55688: Cookie Tossing / Cookie Injection Vulnerability in AsyncHttpClient

#security #cve #cybersecurity

CVE-2026-55688: Cookie Tossing / Cookie Injection Vulnerability in AsyncHttpClient

Vulnerability ID: CVE-2026-55688
CVSS Score: 4.0
Published: 2026-08-26

CVE-2026-55688 is a medium-severity cookie injection vulnerability in the AsyncHttpClient (AHC) library. Due to a failure to validate the domain attribute against the origin server during cookie handling, applications using a shared AHC client instance are vulnerable to cookie-tossing attacks.

TL;DR

AsyncHttpClient versions prior to 2.16.0 and 3.0.11 fail to perform origin domain validation when storing cookies. This allows an attacker-influenced server to inject cookies for arbitrary domains, which are subsequently sent to trusted servers, leading to potential session fixation or CSRF bypass.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-1275, CWE-20, CWE-565
  • Attack Vector: Network (AV:N)
  • CVSS v3.1 Score: 4.0
  • EPSS Score: 0.0033
  • Exploit Status: poc
  • CISA KEV Status: Not Listed

Affected Systems

  • AsyncHttpClient versions 2.0.0 through 2.15.4
  • AsyncHttpClient versions 3.0.0.Beta1 through 3.0.10
  • async-http-client: >= 2.0.0, < 2.16.0 (Fixed in: 2.16.0)
  • async-http-client: >= 3.0.0.Beta1, < 3.0.11 (Fixed in: 3.0.11)

Code Analysis

Commit: 8e4069c

Backport of cookie tossing fix in ThreadSafeCookieStore to 2.x branch

Commit: e6955c1

Fix cookie tossing issue in ThreadSafeCookieStore on 3.x branch

Mitigation Strategies

  • Upgrade AsyncHttpClient to the patched version 2.16.0 or 3.0.11.
  • Do not reuse the same AsyncHttpClient instance for trusted services and untrusted endpoints.
  • Disable cookie storing globally on the client configuration if cookie state preservation is unnecessary for operations.

Remediation Steps:

  1. Locate Maven pom.xml or Gradle build files containing org.asynchttpclient:async-http-client.
  2. Upgrade the dependency version to 2.16.0 for 2.x deployments, or 3.0.11 for 3.x deployments.
  3. Rebuild and execute automated test suites to ensure no regression impacts cookie-reliant client integrations.

References

Read the full report for CVE-2026-55688 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)