CVE-2026-55688 AsyncHttpClient CVE debrief

Who should care

Developers and administrators using AsyncHttpClient library versions 2.0.0 to 2.15.0 and 3.0.0.Beta1 to 3.0.10 in their applications should be aware of this vulnerability and take necessary actions to mitigate the risk. This includes reviewing application dependencies, applying patches, and monitoring for suspicious activity. Security teams and vulnerability management professionals should prioritize assessment and remediation efforts for affected applications.

Technical summary

The AsyncHttpClient library, used in Java applications for asynchronous HTTP requests and responses, contains a vulnerability in versions 2.0.0 to 2.15.0 and 3.0.0.Beta1 to 3.0.10. This vulnerability allows for cookie injection attacks due to improper handling of the Domain attribute when storing cookies. An attacker can plant a cookie for an unrelated domain, which the client will then send on subsequent requests to that domain. This issue affects applications using a single instance of AsyncHttpClient to interact with both attacker-controlled and trusted hosts. Fixes are available in versions 2.16.0 and 3.0.11, addressing the cookie injection issue by properly validating the Domain attribute.

Defensive priority

Medium-priority defensive actions are recommended due to the potential for cookie injection attacks.

Recommended defensive actions

• Inventory and assess applications using AsyncHttpClient library versions 2.0.0 to 2.15.0 and 3.0.0.Beta1 to 3.0.10.
• Apply patches or updates to AsyncHttpClient library versions 2.16.0 or later and 3.0.11 or later.
• Monitor for suspicious cookie activity and implement compensating controls.
• Verify and restrict cookie domains to prevent cookie injection attacks.
• Review security logs for potential cookie injection attempts.
• Implement additional monitoring for affected applications.
• Conduct a thorough review of application dependencies for AsyncHttpClient library versions.

Evidence notes

The AsyncHttpClient library, used for executing HTTP requests and processing responses asynchronously in Java applications, has a vulnerability in versions 2.0.0 to 2.15.0 and 3.0.0.Beta1 to 3.0.10. This issue arises from the ThreadSafeCookieStore storing cookies under the Domain attribute value without verifying if the responding host is allowed to set cookies for that domain. Consequently, this leads to a cookie tossing or cookie injection issue. An attacker can exploit this by setting a cookie for an unrelated domain, which the client will then send on later requests to that domain. Applications using a single AsyncHttpClient instance for both an attacker-influenced host and a trusted host are affected. Evidence from the NVD and GitHub indicates this vulnerability, with fixes available in versions 2.16.0 and 3.0.11. Defenders should verify affected applications, review vendor guidance, and implement compensating controls.

Official resources