Bug#1150936: async-http-client: CVE-2026-107226

[Moritz Mühlenhoff]

Source: async-http-client
X-Debbugs-CC: team at security.debian.org
Severity: important
Tags: security

Hi,

The following vulnerability was published for async-http-client.

CVE-2026-107226[0]:
| The AsyncHttpClient (AHC) library allows Java applications to easily
| execute HTTP requests and asynchronously process HTTP responses.
| From 2.1.0 until 3.0.14, the default ThreadSafeCookieStore does not
| retain whether a Set-Cookie response used a secure transport. It
| accepts Secure cookies received over plaintext and permits insecure
| cookies to overlay or delete existing Secure cookies with matching
| scope. An attacker controlling a plaintext same-site response can
| consequently plant, replace, or remove cookie state later sent to an
| HTTPS origin, enabling session fixation, CSRF-token replacement, or
| loss of security-relevant state. This issue is fixed in version
| 3.0.14.

https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-p2jm-6hj6-9rjg
Fixed by: https://github.com/AsyncHttpClient/async-http-client/commit/6ec7ee45034d154f502852a962d2891746fb82c1 (async-http-client-project-3.0.14)


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-107226
    https://www.cve.org/CVERecord?id=CVE-2026-107226

Please adjust the affected versions in the BTS as needed.