CVE-2026-107226

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-107226

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107226.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-107226

Aliases

GHSA-p2jm-6hj6-9rjg

Downstream

CGA (16)

CLSA (2)

DEBIAN (1)

DEBIAN-CVE-2026-107226

MINI (2)

UBUNTU (1)

UBUNTU-CVE-2026-107226

Published

2026-10-12T18:34:18Z

Modified

2026-10-28T11:04:06Z

Severity

6.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N CVSS Calculator

Summary

AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPS

Details

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 3.0.14, the default ThreadSafeCookieStore does not retain whether a Set-Cookie response used a secure transport. It accepts Secure cookies received over plaintext and permits insecure cookies to overlay or delete existing Secure cookies with matching scope. An attacker controlling a plaintext same-site response can consequently plant, replace, or remove cookie state later sent to an HTTPS origin, enabling session fixation, CSRF-token replacement, or loss of security-relevant state. This issue is fixed in version 3.0.14.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-384",
        "CWE-693"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107226.json"
}

References

Affected packages

Git / github.com/asynchttpclient/async-http-client

Affected ranges

Type

GIT

Repo

https://github.com/asynchttpclient/async-http-client

Events

Introduced

927333da38413759027ccc22a93621da21e7468a

Last Affected

d1f0ccec417092098d40242fee7dfac84bb3c21f

Introduced

9a771c7b40e716ca77a3cad691545b29ff64bfd3

Fixed

bec30bb3d27ad13f069f72b37351c61bff3394ff

Fixed

6ec7ee45034d154f502852a962d2891746fb82c1

Database specific

Show details

{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "2.1.0"
                },
                {
                    "last_affected": "2.16.1"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "introduced": "3.0.0"
                },
                {
                    "fixed": "3.0.14"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "6ec7ee45034d154f502852a962d2891746fb82c1"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "async-http-client-project-3.0.14",
            "range": [
                {
                    "fixed": "bec30bb3d27ad13f069f72b37351c61bff3394ff"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

async-http-client-project-2.*

async-http-client-project-2.1.0

async-http-client-project-2.1.1

async-http-client-project-2.1.2

async-http-client-project-2.10.0

async-http-client-project-2.10.1

async-http-client-project-2.10.2

async-http-client-project-2.10.3

async-http-client-project-2.10.4

async-http-client-project-2.10.5

async-http-client-project-2.11.0

async-http-client-project-2.12.0

async-http-client-project-2.12.1

async-http-client-project-2.12.2

async-http-client-project-2.12.3

async-http-client-project-2.12.4

async-http-client-project-2.14.5

async-http-client-project-2.15.0

async-http-client-project-2.16.0

async-http-client-project-2.16.1

async-http-client-project-2.2.0

async-http-client-project-2.2.1

async-http-client-project-2.3.0

async-http-client-project-2.4.0

async-http-client-project-2.4.1

async-http-client-project-2.4.2

async-http-client-project-2.4.3

async-http-client-project-2.4.4

async-http-client-project-2.4.5

async-http-client-project-2.4.6

async-http-client-project-2.4.7

async-http-client-project-2.4.8

async-http-client-project-2.4.9

async-http-client-project-2.5.0

async-http-client-project-2.5.1

async-http-client-project-2.5.2

async-http-client-project-2.5.3

async-http-client-project-2.5.4

async-http-client-project-2.6.0

async-http-client-project-2.7.0

async-http-client-project-2.8.0

async-http-client-project-2.8.1

async-http-client-project-2.9.0

async-http-client-project-3.*

async-http-client-project-3.0.0

async-http-client-project-3.0.1

async-http-client-project-3.0.10

async-http-client-project-3.0.11

async-http-client-project-3.0.12

async-http-client-project-3.0.13

async-http-client-project-3.0.2

async-http-client-project-3.0.3

async-http-client-project-3.0.4

async-http-client-project-3.0.5

async-http-client-project-3.0.6

async-http-client-project-3.0.7

async-http-client-project-3.0.8

async-http-client-project-3.0.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107226.json"

vanir_signatures

[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "217316347161903099556215415952455512795",
            "length": 456
        },
        "id": "CVE-2026-107226-31d4ab90",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/asynchttpclient/async-http-client/commit/6ec7ee45034d154f502852a962d2891746fb82c1",
        "target": {
            "file": "client/src/main/java/org/asynchttpclient/cookie/ThreadSafeCookieStore.java",
            "function": "get"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "338238052402395334986647125986560981216",
            "length": 199
        },
        "id": "CVE-2026-107226-421f3015",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/asynchttpclient/async-http-client/commit/6ec7ee45034d154f502852a962d2891746fb82c1",
        "target": {
            "file": "client/src/main/java/org/asynchttpclient/cookie/ThreadSafeCookieStore.java",
            "function": "StoredCookie"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "50120323587878703493181012720680118917",
            "length": 647
        },
        "id": "CVE-2026-107226-5b36520c",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/asynchttpclient/async-http-client/commit/6ec7ee45034d154f502852a962d2891746fb82c1",
        "target": {
            "file": "client/src/main/java/org/asynchttpclient/cookie/ThreadSafeCookieStore.java",
            "function": "evictExcessCookies"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "337224062245123061888496665919318703397",
            "length": 147
        },
        "id": "CVE-2026-107226-7ba550b7",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/asynchttpclient/async-http-client/commit/6ec7ee45034d154f502852a962d2891746fb82c1",
        "target": {
            "file": "client/src/main/java/org/asynchttpclient/cookie/ThreadSafeCookieStore.java",
            "function": "add"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "51198981783142500730955291392248918574",
            "length": 496
        },
        "id": "CVE-2026-107226-a4793acb",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/asynchttpclient/async-http-client/commit/6ec7ee45034d154f502852a962d2891746fb82c1",
        "target": {
            "file": "client/src/main/java/org/asynchttpclient/cookie/ThreadSafeCookieStore.java",
            "function": "collectStoredCookies"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "17547544152233955470519640309964215367",
                "231089287870838049348029442804543332096",
                "202254432987872229808474210088917912645",
                "300725193936492699661608649082479798035",
                "73706372020235715699056767056929898330",
                "266803429523453382036054394858743666814",
                "157630181127334803733645047474927203109",
                "207361445703506846747268341338318410798",
                "141754358475766280606340836050977863913",
                "68640273773280602619254747318862187351",
                "332245135540948207948460436388853163340",
                "95324149186542638835448659557811928198",
                "218697952462100442345652514143188832280",
                "329351705518537503653313956284890618362",
                "297540463132978859000604300961123354391",
                "90393287136095257504311332244076562553",
                "288910095540435382256974476969230111638",
                "73337062200638342948222412190087136537",
                "290318488932673391226709554233405465636",
                "106119934520897467637114221613482832294",
                "333410414319324611249549284310311873877",
                "329509958191803131595341287711463769729",
                "139753596148425771615999418951871398521",
                "304586063201920950865679526506638313500",
                "248438227701654675501543919495202289611",
                "215148634534661225447083255330672569929",
                "269387465381265884805397241280190338812",
                "296792048567850113856036180407346533397",
                "97736347333294291922283700192568818510",
                "187461201768143226599793743157557886193",
                "302190641883326527179998463191360793027",
                "262245750624249981117058746882114719863",
                "273319746795889848710821736443027082142",
                "300987216748814170155539064267482179484",
                "8619707425851083094028206771325273360",
                "156632936607380354922422243116052436900",
                "106971851962736637760646789697270711013",
                "288784280086526230282360642688496239209",
                "136367705460047242153497722535292068473",
                "266653017854504597785695437514758024105",
                "55029539335615147714140267731568912750",
                "18096092445179726134384417350636282098",
                "240966578768638154826861599380853063237",
                "109563960295366603875223310823575824071",
                "229752606933640498682610966491841295761",
                "311049525285794685723264305745708170986",
                "188064030324008736890698252215970552852",
                "323170553180638219679427287126762774184",
                "74664456148915340930828661875309650276",
                "323911390963908337488208741810608104294",
                "280077063132267929428354771298183646188",
                "292683017916814361691973266207471854142",
                "252169236763583218197353422978509392865",
                "307753741152924173828260281832246969371",
                "199706864300365705074857039560408682507",
                "265853554354423936980221948243890104140",
                "90985038946937932224326982642249744184",
                "177549416811403656290812049633083817119",
                "56206458745863794508385929890181315745",
                "218778276989554679983110934403543954741",
                "261905301178395956478001295060512009329",
                "189618038809911297459897088954175876542",
                "242206463717125746919693286409597514489",
                "196253891309321195376627509497246768849"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-107226-d2463683",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/asynchttpclient/async-http-client/commit/6ec7ee45034d154f502852a962d2891746fb82c1",
        "target": {
            "file": "client/src/main/java/org/asynchttpclient/cookie/ThreadSafeCookieStore.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "248518704993970841770080760647090300487",
            "length": 119
        },
        "id": "CVE-2026-107226-dfc0f653",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/asynchttpclient/async-http-client/commit/6ec7ee45034d154f502852a962d2891746fb82c1",
        "target": {
            "file": "client/src/main/java/org/asynchttpclient/cookie/ThreadSafeCookieStore.java",
            "function": "get"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "283702288138594927279494313800060740631",
            "length": 948
        },
        "id": "CVE-2026-107226-eef1f629",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/asynchttpclient/async-http-client/commit/6ec7ee45034d154f502852a962d2891746fb82c1",
        "target": {
            "file": "client/src/main/java/org/asynchttpclient/cookie/ThreadSafeCookieStore.java",
            "function": "add"
        }
    }
]

vanir_signatures_modified

"2026-10-28T11:04:06Z"