PT-2026-54858 · Unknown · Async Http Client

Hyperxpro · Published 2026-07-01 · Updated 2026-07-01 · CVE-2026-55688

Positive Technologies (AI Summary)

CVSS v3.1

4.0

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions AsyncHttpClient versions 2.0.0 through 2.15.9 AsyncHttpClient versions 3.0.0.Beta1 through 3.0.10

Description The ThreadSafeCookieStore component fails to verify if a responding host is authorized to set a cookie for a specific domain before storing it under that domain's attribute. This leads to cookie tossing or cookie injection, where a host connected to by the client can plant a cookie scoped to an unrelated domain. Consequently, the client will send this injected cookie in subsequent requests to that unrelated domain. This affects applications using a single, shared CookieStore instance to communicate with both a trusted host and a host influenced by an attacker.

Recommendations Update AsyncHttpClient to version 2.16.0. Update AsyncHttpClient to version 3.0.11.

Exploit

Fix

Weakness Enumeration

CWE-1275

Related Identifiers

CVE-2026-55688

GHSA-M452-Q8C9-RG2F

Affected Products

Async Http Client

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55688.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-55688 · Security Note
• https://osv.dev/vulnerability/CVE-2026-55688 · Vendor Advisory
• https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-m452-q8c9-rg2f · Note
• https://github.com/AsyncHttpClient/async-http-client/pull/2196 · Note
• https://t.me/cveNotify/184143 · Telegram Post
• https://twitter.com/CVEnew/status/2072441320115683359 · Twitter Post
• https://twitter.com/infoflowcloud/status/2072442923765928425 · Twitter Post