CVE-2026-55688
- Source
- https://cve.org/CVERecord?id=CVE-2026-55688
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55688.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-55688
- Aliases
-
- GHSA-m452-q8c9-rg2f
- Downstream
- Published
- 2026-07-01T19:40:12.004Z
- Modified
- 2026-07-15T18:01:33.480929Z
- Severity
-
- 4.0 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N CVSS Calculator
- Summary
- AsyncHttpClient: Cookie stored for an unrelated domain (cookie tossing) via ThreadSafeCookieStore
- Details
-
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. In versions from 2.0.0 prior to 2.16.0 and from 3.0.0.Beta1 prior to 3.0.11, ThreadSafeCookieStore stored a cookie under the value of its Domain attribute without verifying that the responding host is allowed to set a cookie for that domain, leading to a cookie tossing / cookie injection issue. A host the client connects to can therefore plant a cookie scoped to an unrelated domain, and the client will then send that cookie on later requests to that domain. Applications that use a single AsyncHttpClient instance - and thus the default, shared CookieStore - to reach both an attacker-influenced host and a trusted host are impacted. This issue has been fixed in versions 2.16.0 and 3.0.11.
- Database specific
{ "cwe_ids": [ "CWE-1275" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55688.json", "cna_assigner": "GitHub_M" }- References
Affected packages
Git / github.com/asynchttpclient/async-http-client
Affected ranges
- Type
- GIT
- Repo
- https://github.com/asynchttpclient/async-http-client
- Events
-
IntroducedFixedIntroduced0 Unknown introduced commit / All previous commits are affectedFixed
- Database specific
{ "source": "AFFECTED_FIELD", "extracted_events": [ { "introduced": "2.0.0" }, { "fixed": "2.16.0" }, { "introduced": "3.0.0.Beta1" }, { "fixed": "3.0.11" } ] }
Affected versions
async-http-client-project-2.*
async-http-client-project-2.0.0
async-http-client-project-2.0.1
async-http-client-project-2.0.10
async-http-client-project-2.0.11
async-http-client-project-2.0.12
async-http-client-project-2.0.13
async-http-client-project-2.0.14
async-http-client-project-2.0.15
async-http-client-project-2.0.16
async-http-client-project-2.0.17
async-http-client-project-2.0.18
async-http-client-project-2.0.19
async-http-client-project-2.0.2
async-http-client-project-2.0.20
async-http-client-project-2.0.21
async-http-client-project-2.0.22
async-http-client-project-2.0.23
async-http-client-project-2.0.24
async-http-client-project-2.0.3
async-http-client-project-2.0.4
async-http-client-project-2.0.5
async-http-client-project-2.0.6
async-http-client-project-2.0.7
async-http-client-project-2.0.8
async-http-client-project-2.0.9
async-http-client-project-2.1.0
async-http-client-project-2.1.0-RC1
async-http-client-project-2.1.0-RC2
async-http-client-project-2.1.0-RC3
async-http-client-project-2.1.0-RC4
async-http-client-project-2.1.0-alpha10
async-http-client-project-2.1.0-alpha11
async-http-client-project-2.1.0-alpha12
async-http-client-project-2.1.0-alpha13
async-http-client-project-2.1.0-alpha14
async-http-client-project-2.1.0-alpha15
async-http-client-project-2.1.0-alpha16
async-http-client-project-2.1.0-alpha17
async-http-client-project-2.1.0-alpha18
async-http-client-project-2.1.0-alpha19
async-http-client-project-2.1.0-alpha2
async-http-client-project-2.1.0-alpha20
async-http-client-project-2.1.0-alpha21
async-http-client-project-2.1.0-alpha22
async-http-client-project-2.1.0-alpha23
async-http-client-project-2.1.0-alpha24
async-http-client-project-2.1.0-alpha25
async-http-client-project-2.1.0-alpha26
async-http-client-project-2.1.0-alpha3
async-http-client-project-2.1.0-alpha4
async-http-client-project-2.1.0-alpha5
async-http-client-project-2.1.0-alpha6
async-http-client-project-2.1.0-alpha7
async-http-client-project-2.1.0-alpha8
async-http-client-project-2.1.0-alpha9
async-http-client-project-2.1.1
async-http-client-project-2.1.2
async-http-client-project-2.10.0
async-http-client-project-2.10.1
async-http-client-project-2.10.2
async-http-client-project-2.10.3
async-http-client-project-2.10.4
async-http-client-project-2.10.5
async-http-client-project-2.11.0
async-http-client-project-2.12.0
async-http-client-project-2.12.1
async-http-client-project-2.12.2
async-http-client-project-2.12.3
async-http-client-project-2.12.4
async-http-client-project-2.14.5
async-http-client-project-2.15.0
async-http-client-project-2.2.0
async-http-client-project-2.2.1
async-http-client-project-2.3.0
async-http-client-project-2.4.0
async-http-client-project-2.4.1
async-http-client-project-2.4.2
async-http-client-project-2.4.3
async-http-client-project-2.4.4
async-http-client-project-2.4.5
async-http-client-project-2.4.6
async-http-client-project-2.4.7
async-http-client-project-2.4.8
async-http-client-project-2.4.9
async-http-client-project-2.5.0
async-http-client-project-2.5.1
async-http-client-project-2.5.2
async-http-client-project-2.5.3
async-http-client-project-2.5.4
async-http-client-project-2.6.0
async-http-client-project-2.7.0
async-http-client-project-2.8.0
async-http-client-project-2.8.1
async-http-client-project-2.9.0
async-http-client-project-3.*
async-http-client-project-3.0.0
async-http-client-project-3.0.0.Beta2
async-http-client-project-3.0.0.Beta3
async-http-client-project-3.0.1
async-http-client-project-3.0.10
async-http-client-project-3.0.2
async-http-client-project-3.0.3
async-http-client-project-3.0.4
async-http-client-project-3.0.5
async-http-client-project-3.0.6
async-http-client-project-3.0.7
async-http-client-project-3.0.8
async-http-client-project-3.0.9
Database specific
vanir_signatures_modified
"2026-07-15T18:01:33Z"
vanir_signatures
[
{
"signature_type": "Function",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/channel/Http2ConnectionState.java",
"function": "failPendingOpeners"
},
"deprecated": false,
"source": "https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841",
"id": "CVE-2026-55688-06063aec",
"signature_version": "v1",
"digest": {
"function_hash": "44975579509482547796929415059736372416",
"length": 327.0
}
},
{
"signature_type": "Function",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/request/body/NettyBodyBody.java",
"function": "writeHttp2"
},
"deprecated": false,
"source": "https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841",
"id": "CVE-2026-55688-062fc495",
"signature_version": "v1",
"digest": {
"function_hash": "296700625155990128381699229250756753105",
"length": 676.0
}
},
{
"signature_type": "Line",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/channel/Http2ConnectionState.java"
},
"deprecated": false,
"source": "https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841",
"id": "CVE-2026-55688-09fca8ce",
"signature_version": "v1",
"digest": {
"line_hashes": [
"66353816393948610465640071874358599060",
"35308391353028351047240930206124859650",
"282441467923727243482924918725562656160",
"11519708396642306768317595505269948169",
"225200936621203192959380021319234322409",
"160303418982299148444497851108039446188",
"300831267659452715708208641226784191926",
"180821845151439604975882881031261586042",
"335718780355233395297631058319805978441",
"335113890496296953035822630695275774510",
"171869641833338953541694454702770655384",
"293330140989696916165180066052707925467",
"149274859611007636196341016424657425610",
"112561460209307833380074760902164545279",
"94236156674998454197692827156980800003",
"316205818859795747471717291913709269400",
"268070654145490106305704594352130143447",
"271328056780873899799391498920785639233",
"101527035609062652968353036492671207129",
"101982956185370935582634388850870197328",
"38574607982236247394632632873181100408",
"92519068849816447307278865816663557899",
"257370819034713042174494219143873879534",
"264250601602314187021872154731153132811",
"155069998730465509408563944799685302915",
"303891523450830975886547822071709613607",
"52317908348607500759038391207130582672",
"92343166313397357680242902796050123992",
"287513725331046405546235080535560817354",
"101092394822257697744099942146477851483",
"220001843139839937567322889133188044357",
"33591276877287026892896601682868491613",
"21043134715269664204436988083293621120",
"108587633537507210242609878158511307392",
"153347004142734436433786707547856625513",
"131449213129789546701294834845604727686",
"191066590484138786622285781173692804592",
"202551752738896923615678257639701647243",
"149258456836056734570493270930444453448",
"239517702362199352366246097113720053894",
"16040855383711605731873859050995334371",
"157138979815360474822173661892435017549",
"247460361513995900026113597640723948903",
"200954639384020889982429585812987107971",
"37309178804951720828965788766351721689",
"193459236542493488137889890841025902469",
"30315164336467555955266071962719576263",
"142017936197813123984045005042570979210",
"187963895566370372490631228114749291689",
"297550495264964601200147231034137308738",
"289175974947757586899988472577109695747",
"200266760314516268817612035065448384295"
],
"threshold": 0.9
}
},
{
"signature_type": "Line",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/request/body/NettyInputStreamBody.java"
},
"deprecated": false,
"source": "https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841",
"id": "CVE-2026-55688-179345ad",
"signature_version": "v1",
"digest": {
"line_hashes": [
"242250493679994314132694752406105459307",
"119478040034929904717843503902460816388",
"134348603463405165225569330065034686670",
"36524855504918587287391462379405395736",
"237186804977069426748323423062675845937",
"37819928813824924460478232220385026570",
"8106939934178307541358778535197855240",
"50212362452578065505907049194139850339",
"201253331875016951360261220037677127748",
"70005005353871734753287315931418518425",
"128181155288660839166551230282268657089",
"19694594199891769829050549362511967841",
"174203533653798107372468592522510861982",
"227876663145642276015265252969243466693",
"20586162578199137518971701370810526240",
"285943468217458678185028982473838981917",
"188519978991228650459674477467888432343",
"334329571144545721476460363199177920867",
"222722536360366219043188065991632827909",
"267958417761499678001707489934473885014",
"296801064023302773759194481231997397220",
"227209310640742311740714277834120580948",
"55924631672034263402623580597187830075",
"61733901935397966076329699146656555901",
"74899881096606278272589085391519212773",
"83140913580940856236847688469755972084",
"255069459670660148643073613385987983820",
"336421145927775472855118539803013243531",
"26425960058003503354921305046070411298",
"271480802128666347613602299773792263838",
"277602755914854912184251271334177210446",
"107037793189982159901034341098328835228",
"26383279938739521069636673587667012893"
],
"threshold": 0.9
}
},
{
"signature_type": "Line",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/request/body/NettyByteBufBody.java"
},
"deprecated": false,
"source": "https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841",
"id": "CVE-2026-55688-196c41e3",
"signature_version": "v1",
"digest": {
"line_hashes": [
"206873690685477244434521360242820995681",
"205842803213208165473724997029828324463",
"98421564311458972147563533820343249757"
],
"threshold": 0.9
}
},
{
"signature_type": "Line",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/channel/ChannelManager.java"
},
"deprecated": false,
"source": "https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841",
"id": "CVE-2026-55688-19dbe7da",
"signature_version": "v1",
"digest": {
"line_hashes": [
"30387104020841064882001778204474212222",
"12668499004021422738884031629684437480",
"323376399883849058076283062316441365177",
"182974986772885460164015591309792566570",
"40055171979285218887616861524842569091",
"152243798662650721123474849844260069174",
"300171396396576497607094817614662512937",
"137075780703861729422623027693387942380",
"26391102038949804322075822929420572224",
"203890281723701381215341918921436854303",
"207914708018679425204217618907303113003",
"203888250600956396938725301008172121898",
"55389601495400597277244868498036809545",
"157734109042204311654643789764732395284",
"27572453550939595642716214616775206473",
"44716018448471596964521692241634999107",
"163903292257579748773166496628820359112",
"284335186230950740508886841132360202993",
"106805832610637182014083194920571863882",
"132543267269006944837788834708118679709",
"31288899329313873179287531982671508602",
"113195104897998115666121984855156554863",
"147719988716123521854913398170595050376",
"173253908659046786200185532242727345409",
"308481199433183374443119793301376030360",
"53497044420723775521156741768727640704",
"267830811371516781298827716936616445644",
"300416954753418904481266580044919455835",
"75184923541567514448972435340877359851",
"323559123544074482199205754868945477655",
"241751153729464819547645949918936870867",
"201424870153828401403498758751119414587",
"326863058870020238480507581343369821081",
"19773588267085927550518046533532815736",
"211454256670965128911327767055538852261",
"138749734233103715698554388838273512927",
"131109859723492007755513339960627611039",
"64297089482167897594550660318799377499",
"67837271545297122567906410664952105780",
"167273743486226684720184606242833823258",
"269706618946317496940019230930227355071",
"118086504969977785027497946243631643679"
],
"threshold": 0.9
}
},
{
"signature_type": "Function",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/handler/Http2Handler.java",
"function": "finishUpdate"
},
"deprecated": false,
"source": "https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841",
"id": "CVE-2026-55688-1d51e100",
"signature_version": "v1",
"digest": {
"function_hash": "116140448022794800141090635778853099912",
"length": 733.0
}
},
{
"signature_type": "Function",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/request/body/NettyFileBody.java",
"function": "writeHttp2"
},
"deprecated": false,
"source": "https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841",
"id": "CVE-2026-55688-208b8b36",
"signature_version": "v1",
"digest": {
"function_hash": "271894221060082503565533345385317254824",
"length": 605.0
}
},
{
"signature_type": "Function",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/ssl/DefaultSslEngineFactory.java",
"function": "destroy"
},
"deprecated": false,
"source": "https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841",
"id": "CVE-2026-55688-35550802",
"signature_version": "v1",
"digest": {
"function_hash": "275674064103793596354852831996366480838",
"length": 69.0
}
},
{
"signature_type": "Line",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/channel/NettyConnectListener.java"
},
"deprecated": false,
"source": "https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841",
"id": "CVE-2026-55688-36b20b10",
"signature_version": "v1",
"digest": {
"line_hashes": [
"23499922274628029249708441184748639894",
"242629825859646686624600689169833262073",
"164056084286574539867358777117753210819",
"271204716706183541073201619006865142767",
"63782250107979814339657066159036833186",
"35323813022816800573358915457953712470",
"293310067559342945337884239780677034561",
"35463585654461201264951653831021873919",
"202507809385195696899643867705494033822"
],
"threshold": 0.9
}
},
{
"signature_type": "Function",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/channel/ChannelManager.java",
"function": "registerHttp2Connection"
},
"deprecated": false,
"source": "https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841",
"id": "CVE-2026-55688-39251935",
"signature_version": "v1",
"digest": {
"function_hash": "62134210931991528266995397700680488304",
"length": 453.0
}
},
{
"signature_type": "Line",
"target": {
"file": "client/src/main/java/org/asynchttpclient/AsyncHttpClientConfig.java"
},
"deprecated": false,
"source": "https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841",
"id": "CVE-2026-55688-3a64d652",
"signature_version": "v1",
"digest": {
"line_hashes": [
"65514355774884786596166886907006677558",
"92237267947547220853754716769339477193",
"113904975625080614497739738539041195842"
],
"threshold": 0.9
}
},
{
"signature_type": "Function",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/handler/Http2ContentDecompressor.java",
"function": "channelRead"
},
"deprecated": false,
"source": "https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841",
"id": "CVE-2026-55688-3a690f30",
"signature_version": "v1",
"digest": {
"function_hash": "107223354646639030966220716861755217121",
"length": 1381.0
}
},
{
"signature_type": "Function",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/channel/ChannelManager.java",
"function": "channelRead"
},
"deprecated": false,
"source": "https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841",
"id": "CVE-2026-55688-3eafebb9",
"signature_version": "v1",
"digest": {
"function_hash": "29262025889899362940984181399984401602",
"length": 663.0
}
},
{
"signature_type": "Line",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/handler/Http2Handler.java"
},
"deprecated": false,
"source": "https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841",
"id": "CVE-2026-55688-40a288fb",
"signature_version": "v1",
"digest": {
"line_hashes": [
"331420566744053957333700151936609490516",
"172908099278555920287383350121870039610",
"204403288090289922930835821291126756762",
"299120130318513276035765519920054186589",
"22210761941359419526072853066046015239",
"40195187519526841299905752981857343691",
"187042589468553246671591464849039551993",
"121537253180954534583755708686100880422",
"210161652503588362051299215919973371565",
"213942316784240751628743045320773426466",
"328872615763461957293605179439451842916",
"275114377191418575894409610634402619047",
"324742325186772323858961173242143212662",
"128253365039529711112337935966076832649",
"99982950036736928505828362736057134308",
"272914591891822720408691685594581397894",
"82820148192626586175376501729509909297",
"331863260025877289096634620880446436479",
"161888342602280032988081820913766372025",
"13598574962394888815310333763461376110",
"276791764247077884598335992525211194956",
"249621355926232301335824388780276145042",
"66159217237331809296461531240523641006",
"259605536103992416080480072383959409312",
"233403252646901134146420527399456437252",
"199664187969668648995955416662005014745",
"263507763031456120101037369714001956115",
"135367410001120105491179319981031475136",
"263790351756826580002210128074404297526",
"87920190326234021607711196873582135156",
"258571140505852165431853619700550475172",
"96688490052737482050865671548390071961",
"12638854611943742434836417397840492526",
"254445378337222594665903793433362791128",
"336372340702314468676608540375058545050",
"175296242479120512798802895177490827563",
"251204868730290356311175285148218474928",
"323022789488561865276913126606560261741",
"111561699803785005183398276490488135544",
"26763098645125250874257271515038233827",
"274441805055325308306994114543642816711",
"210735214142527992415751662419442269479",
"181967710510849916724946580214627648442",
"321740245126393100629073083812589339027",
"283085079909249862094810433503972100195",
"265519583346637777181634882398478723638",
"135921941510739264463729185044723093246",
"8236251418872552143243413469570562921",
"312395617489134079876207300617752271841",
"164778276513695769331039067968923988625",
"3656602936512943670219118833402273254",
"282986450170246514544336002761482838834",
"10491779843739574951867755388110533828",
"78197176440871400854394920731693555682",
"271733600446492949377041053783317932057",
"72767972669176411155723167712317929079",
"168790186836677457107862705071216027202",
"6400593176737285015285305087006250998",
"71686375905391617280977266467612139193",
"253266921858392035763631401309454706",
"42319695417763052543471199088391901649",
"147677714870184613821365853307681871985",
"57383178451509262401631799651005834377",
"66226398544360526860303599424549720324",
"261642277360173620807265763074375440254",
"133361669883240955540691910880710534216",
"165938058828127821941288858541315497393",
"111055398415940251326156426170214857036",
"169690680049066928281353092282071908586",
"1205959798521751159354129434213395345",
"96703308281564332601244130088514008607",
"321951856222181648061925505034209076340",
"83923270324275790776177234421338945294",
"181491998066711094553921293099613562136",
"90353017723780946529288450447877298189",
"160875111172549089442548863226362374988",
"284380021583096358995631701243807592850",
"37866020084531473303668228810875086900",
"112328211606016515887604772158007898633",
"18114830952942327973296676555535938317",
"299816070478351474253289796724338866881",
"274045158407530882937016836974570367565",
"326196488866761082224298665690526882694",
"287855594216154706363058924581433348667",
"204109771800292452668686454357203323549",
"231877598785702182126053318446241192411"
],
"threshold": 0.9
}
},
{
"signature_type": "Function",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/ssl/DefaultSslEngineFactory.java",
"function": "buildSslContext"
},
"deprecated": false,
"source": "https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841",
"id": "CVE-2026-55688-40b6d065",
"signature_version": "v1",
"digest": {
"function_hash": "171407218849963972580305150638791810878",
"length": 1110.0
}
},
{
"signature_type": "Line",
"target": {
"file": "client/src/test/java/org/asynchttpclient/CookieStoreTest.java"
},
"deprecated": false,
"source": "https://github.com/asynchttpclient/async-http-client/commit/8e4069cf3c92abe099db5fb13378ac2fe9e1fd3b",
"id": "CVE-2026-55688-4444dbc3",
"signature_version": "v1",
"digest": {
"line_hashes": [
"158694078049405266416936617745272244885",
"171135242912738179266975243258241950028",
"80672101766945575573065386917627806633",
"178874045802535394242559641107901208251",
"329177339630615529659516686781782560849",
"14462809932617956612360595160714261880",
"63673591984520693134057432017329118878"
],
"threshold": 0.9
}
},
{
"signature_type": "Function",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/channel/Http2ConnectionState.java",
"function": "addPendingOpener"
},
"deprecated": false,
"source": "https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841",
"id": "CVE-2026-55688-46d4d555",
"signature_version": "v1",
"digest": {
"function_hash": "187591754750909286346038167362963481133",
"length": 200.0
}
},
{
"signature_type": "Line",
"target": {
"file": "client/src/main/java/org/asynchttpclient/SslEngineFactory.java"
},
"deprecated": false,
"source": "https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841",
"id": "CVE-2026-55688-4a0f2b79",
"signature_version": "v1",
"digest": {
"line_hashes": [
"47030553866274257733845357714686287567",
"337936671732551968771661954460168101164",
"261755117747922094816723719857411135746"
],
"threshold": 0.9
}
},
{
"signature_type": "Function",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/request/NettyRequestSender.java",
"function": "sendHttp2Frames"
},
"deprecated": false,
"source": "https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841",
"id": "CVE-2026-55688-55476495",
"signature_version": "v1",
"digest": {
"function_hash": "197865424274849202373734750738025001715",
"length": 1421.0
}
},
{
"signature_type": "Function",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/request/NettyRequestSender.java",
"function": "replayRequest"
},
"deprecated": false,
"source": "https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841",
"id": "CVE-2026-55688-56f8711d",
"signature_version": "v1",
"digest": {
"function_hash": "138863181786070727138819902544997728283",
"length": 528.0
}
},
{
"signature_type": "Function",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/NettyResponseFuture.java",
"function": "terminateAndExit"
},
"deprecated": false,
"source": "https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841",
"id": "CVE-2026-55688-5b22566a",
"signature_version": "v1",
"digest": {
"function_hash": "112355423577261647750594299033178337314",
"length": 164.0
}
},
{
"signature_type": "Line",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/request/NettyRequest.java"
},
"deprecated": false,
"source": "https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841",
"id": "CVE-2026-55688-60038bf0",
"signature_version": "v1",
"digest": {
"line_hashes": [
"218749333867074229323244942630791484244",
"73185341731785929753638125403726501648",
"15283995770994737244021730660571898221",
"45016011273002945303459210625814929336",
"254056173230260832411622882832341344682",
"169267155448077540245293946248312309150",
"335890207982397433623437939547914188796",
"149320191733992689214235522110139875773"
],
"threshold": 0.9
}
},
{
"signature_type": "Function",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/channel/NettyConnectListener.java",
"function": "onSuccess"
},
"deprecated": false,
"source": "https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841",
"id": "CVE-2026-55688-60edc56a",
"signature_version": "v1",
"digest": {
"function_hash": "329082949233564416226119730793375327272",
"length": 3397.0
}
},
{
"signature_type": "Function",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/request/NettyRequestSender.java",
"function": "writeRequest"
},
"deprecated": false,
"source": "https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841",
"id": "CVE-2026-55688-631a3ea8",
"signature_version": "v1",
"digest": {
"function_hash": "63169110221114494456355467625833112187",
"length": 1173.0
}
},
{
"signature_type": "Line",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/request/body/NettyFileBody.java"
},
"deprecated": false,
"source": "https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841",
"id": "CVE-2026-55688-69a60dcf",
"signature_version": "v1",
"digest": {
"line_hashes": [
"43234481567836024354982964593009412583",
"106926726704586526797830498738079180838",
"103699109810858269306262352698377166334",
"49568881603497354439195487917353570102",
"304405860611796965125883930351264563394",
"79352675734159107548374137752281591861",
"52007657951139366207821688184676818340",
"212898588932452547909587829389745076714",
"334700775958751972638922092179472083528",
"34326878805288320380613891915263213164",
"89699450437747646431818322223450139699",
"199146600752441980623400094240646025482",
"338457943196944953178878972532077470499",
"177034105801730586818708960815120907586",
"226782367654192064923589983411434275103",
"59975153372591601826038623723763037452",
"238992659687193156296731477363015188293",
"304140352000694679253443591536122307788",
"186302725698027929136435460471796886077",
"184268107055853823967755429207662669737",
"177087033745066094537233351839267987123",
"329365707142571374793624336132294694462",
"204773980137262831373989017037581499739",
"34475393087969777365987435919213678807",
"230638529051984127253107946194582826123",
"169675414726816804530549398270080412397",
"108412739631672893142853127786287850013",
"260346270132000266114162419174526842916",
"263868593844087527307990423928178287852",
"92349052548863752660197021101077700970",
"336674137555455975798072033562033366762",
"18747295951711707560918935415607112657",
"180771468269998263266350932322240468207"
],
"threshold": 0.9
}
},
{
"signature_type": "Function",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/handler/Http2Handler.java",
"function": "handleHttp2GoAwayFrame"
},
"deprecated": false,
"source": "https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841",
"id": "CVE-2026-55688-722252f0",
"signature_version": "v1",
"digest": {
"function_hash": "166683599770149753714482319578308494343",
"length": 726.0
}
},
{
"signature_type": "Function",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/request/body/NettyByteBufBody.java",
"function": "byteBuf"
},
"deprecated": false,
"source": "https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841",
"id": "CVE-2026-55688-73637417",
"signature_version": "v1",
"digest": {
"function_hash": "222486790472277647262725066761723456455",
"length": 34.0
}
},
{
"signature_type": "Function",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/channel/ChannelManager.java",
"function": "upgradePipelineToHttp2"
},
"deprecated": false,
"source": "https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841",
"id": "CVE-2026-55688-761aded3",
"signature_version": "v1",
"digest": {
"function_hash": "167368227436023272784031870133224998352",
"length": 2938.0
}
},
{
"signature_type": "Line",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/handler/intercept/Continue100Interceptor.java"
},
"deprecated": false,
"source": "https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841",
"id": "CVE-2026-55688-76a1beac",
"signature_version": "v1",
"digest": {
"line_hashes": [
"238488509598723669886965221710324415265",
"33513890791641622038294298341188533263",
"23421816313708723441256155081640002005",
"188528807130293954447079886940457633685",
"57225978491809188686291322922614429403",
"86594882120978413614309525363317485280",
"132117635214832278560476572058150705875",
"247607905697590598089858295074676108049"
],
"threshold": 0.9
}
},
{
"signature_type": "Line",
"target": {
"file": "client/src/main/java/org/asynchttpclient/cookie/ThreadSafeCookieStore.java"
},
"deprecated": false,
"source": "https://github.com/asynchttpclient/async-http-client/commit/8e4069cf3c92abe099db5fb13378ac2fe9e1fd3b",
"id": "CVE-2026-55688-77fb64cd",
"signature_version": "v1",
"digest": {
"line_hashes": [
"213105997135152581652968871498355794991",
"10212155504525293776912577917305845336",
"12055171428288684154746124412619865672",
"73337062200638342948222412190087136537",
"53616234612576811078396385320379538850",
"279213141767620651758839923362383040273",
"169528175273420128919069556898530255284"
],
"threshold": 0.9
}
},
{
"signature_type": "Line",
"target": {
"file": "client/src/main/java/org/asynchttpclient/config/AsyncHttpClientConfigDefaults.java"
},
"deprecated": false,
"source": "https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841",
"id": "CVE-2026-55688-78cc73e9",
"signature_version": "v1",
"digest": {
"line_hashes": [
"302936636447435158194391065056668651861",
"235383983289592658209175924648113956068",
"193257605427120266049235920493560141376",
"158559275522236753205798642233556734687",
"48517308577934852841711849473363075497",
"266006314506856806421845306519835919802",
"242128824826815097089724170022570558046"
],
"threshold": 0.9
}
},
{
"signature_type": "Function",
"target": {
"file": "client/src/main/java/org/asynchttpclient/DefaultAsyncHttpClientConfig.java",
"function": "DefaultAsyncHttpClientConfig"
},
"deprecated": false,
"source": "https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841",
"id": "CVE-2026-55688-7c43cbfe",
"signature_version": "v1",
"digest": {
"function_hash": "38930259353658025811737418076055003795",
"length": 3642.0
}
},
{
"signature_type": "Line",
"target": {
"file": "client/src/test/java/org/asynchttpclient/netty/channel/Http2ConnectionStateTest.java"
},
"deprecated": false,
"source": "https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841",
"id": "CVE-2026-55688-7f57796b",
"signature_version": "v1",
"digest": {
"line_hashes": [
"152536460709786297217477216436219884632",
"316953234518142422382571033535226096024",
"221669867940264415062960617283922098067",
"8777889931199012878636135424809568587",
"230568940715260754825173628237455802946",
"232631314251032700592408790673940850043",
"124294884952525780967922658264442800311",
"47662802032278731534011784110877745664",
"267726936926692496970479416272209400135",
"61983421264997182432503364475873229309",
"283527052124018485654681881085888405566",
"70633997864646297367083755602503146802"
],
"threshold": 0.9
}
},
{
"signature_type": "Function",
"target": {
"file": "client/src/main/java/org/asynchttpclient/cookie/ThreadSafeCookieStore.java",
"function": "add"
},
"deprecated": false,
"source": "https://github.com/asynchttpclient/async-http-client/commit/8e4069cf3c92abe099db5fb13378ac2fe9e1fd3b",
"id": "CVE-2026-55688-81555d1a",
"signature_version": "v1",
"digest": {
"function_hash": "152155023182119484639324774900451504434",
"length": 629.0
}
},
{
"signature_type": "Line",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/request/NettyRequestSender.java"
},
"deprecated": false,
"source": "https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841",
"id": "CVE-2026-55688-81897264",
"signature_version": "v1",
"digest": {
"line_hashes": [
"119438064821204654527666649248050150065",
"328722048546505302948152496876179917883",
"268057102184108587579378557141457668311",
"64827448314790781292590797081325685822",
"41350140154874667804192723212534962118",
"265889736200413525914262829601606835972",
"263205685604113117441683520472033259600",
"260198884774265558986925309967764129004",
"253131997496848017946137665911012374330",
"114792842660887897915864266532500638140",
"101031112135952466817999097772340825970",
"138117599714847111901526776892972410068",
"22558284444522201235079307786194655974",
"225141374320266377895636359298927146057",
"212531447601761163630482216181422748885",
"174582711957234839280158076217416073893",
"77119017413531946453999642114890287042",
"117891111654773154578913123709743242627",
"126315694668231985055390076639009071996",
"17797079410239809468692490146152490971",
"194659921297205753202857660027825427279",
"287270733906301624515036951047601142973",
"84751998937269858891062071490659352642",
"127425476045057162049527869470355510321",
"217274093369932740370049880536591652535",
"333877690146389071158799956899381008898",
"322211877141011197746788659147198190785",
"218535501318121854924102623797542974891",
"109350697984883551123052990286479965207",
"329810287938724830529556016226017313113",
"316655672894079057978818822929500369330",
"160322489007861403179407675151234899331",
"233854164788666339457796793697441253769",
"152515983681803672134917444568264428888",
"83610187721576132085794535543123361834",
"88535203818143263222585216836005944972",
"78727551835126382735215580687790308066",
"8160598211745673789442787982319417235",
"140399567649889734699934598002559531000",
"165445541286325090999973180153715065505",
"193359388028822315689935103790429025678",
"215267328122295418973128274661678810554",
"67415210526953518110762410921559385838",
"115076125944813892498984083265954674182",
"76206956581384963918567199616939193788",
"323148810888511038706390055939107850721",
"320014996965433968187636579928702117955",
"104878824886945060295906440718212221810",
"21319698604801956487012143921397624660",
"183550410269421174430782407159474084424",
"214003308012987977612766041557308660047",
"103912147359821341690436186232832358501",
"53434846878988809120472197087841579931",
"18464479813929328347254840671184630392",
"246837877891897133430343883014399797707",
"28427204224473637243074491978836454122",
"249864750869477197945035250112258159485",
"278034970308112471479559708214328084909",
"64290222686710358127826548633299449775",
"53943899456994187335085210604781301749",
"186231181252230110201330992854339878626",
"193758914859295163360222098988348470608",
"54485919864780511360620876498885010462",
"37916261028138988206031848771081828593",
"329663999712491363884140171302047788807",
"136615643943171052074471351131508271035",
"272979133563838663822667065511600585229",
"254057645057765213456592858568060093933",
"312149842907834952296704992922108441828",
"247405022949703356732840169453871723213",
"159358151100504114368697421753941451086",
"234843377578913068413002978608026392906",
"271421210173194427491627102594390974105",
"167914451854597759254808418980242477373",
"56563442844604040667369838556717623685",
"175942152726326671577483304448899154236",
"274611908366911172321232217380882307057",
"106300900141301255667116023987752688451",
"43952656746146667528571662813971245721",
"95030952540972880986327889840330919308",
"78958662060145784505842811204724019858",
"161020830748497431117891169703836163440",
"44936002785290566543620339227304770365",
"185829317418361117631687956664160727685",
"53687472147514557973277878893419415512",
"336898015029734688639444097305688192885",
"270465106146820704298572222839963078193",
"117928808956263186476686617431228296828",
"223309730575705323857706399252871873214",
"43531793306695634077137719646516863388",
"46332837857357047214276399329821886410",
"68277911454634018011170046462887321252",
"269128677273640212386780612120814103474",
"287250289630927934608562093511368749155",
"155618589147297644052450498991858903127",
"20428005903588097098685906001452302152",
"274609612330602945186971393754903323007",
"210490949247195093303971834520135466309",
"156997295985406667224646053232742923588",
"325635478339527807332616613181117296378",
"228031060324608349883453185535983386942",
"85563517347429217284341669234971986245",
"177967773986800779072950689029184005846",
"334103427562097124528718158897849811220",
"134380095233647964553203460944895933995",
"259724774940983901995622325634918586481",
"61025083897568171931463998608185095356",
"244197461709863595090417320005081324545",
"157575214813254339221158132103101326585",
"173461583142720571125306706136920034676",
"245837367218127451674185382723069448861",
"196696198018771358768409457672477368111",
"247232625726992285446261226510445607546",
"155526068976230444869076891726773769221",
"229578786116513567594204845181228971862",
"202606261617367563307231778594065014610",
"68700956244922154674275309168636290655",
"6026176318056230065158563020927246265",
"207397979671457024932177085403761644426"
],
"threshold": 0.9
}
},
{
"signature_type": "Function",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/handler/Http2Handler.java",
"function": "handleHttp2HeadersFrame"
},
"deprecated": false,
"source": "https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841",
"id": "CVE-2026-55688-827df6ce",
"signature_version": "v1",
"digest": {
"function_hash": "17530926016445692667262961388555296545",
"length": 996.0
}
},
{
"signature_type": "Function",
"target": {
"file": "client/src/main/java/org/asynchttpclient/DefaultAsyncHttpClientConfig.java",
"function": "build"
},
"deprecated": false,
"source": "https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841",
"id": "CVE-2026-55688-845014f7",
"signature_version": "v1",
"digest": {
"function_hash": "254694623578577446641236813949157593445",
"length": 2216.0
}
},
{
"signature_type": "Function",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/channel/ChannelManager.java",
"function": "updatePipelineForHttpTunneling"
},
"deprecated": false,
"source": "https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841",
"id": "CVE-2026-55688-8f9a8cf2",
"signature_version": "v1",
"digest": {
"function_hash": "324723830007739038815144036255536192815",
"length": 936.0
}
},
{
"signature_type": "Function",
"target": {
"file": "client/src/test/java/org/asynchttpclient/netty/channel/Http2ConnectionStateTest.java",
"function": "addPendingOpenerWithZeroMaxConcurrentStreams"
},
"deprecated": false,
"source": "https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841",
"id": "CVE-2026-55688-94e793a7",
"signature_version": "v1",
"digest": {
"function_hash": "239085649823358910813012296282530369024",
"length": 343.0
}
},
{
"signature_type": "Function",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/ssl/DefaultSslEngineFactory.java",
"function": "newSslEngine"
},
"deprecated": false,
"source": "https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841",
"id": "CVE-2026-55688-988a559d",
"signature_version": "v1",
"digest": {
"function_hash": "129859699811618843167518732807283790682",
"length": 276.0
}
},
{
"signature_type": "Function",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/handler/intercept/Continue100Interceptor.java",
"function": "exitAfterHandling100"
},
"deprecated": false,
"source": "https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841",
"id": "CVE-2026-55688-9de62cc4",
"signature_version": "v1",
"digest": {
"function_hash": "63911647829183348703923769887667119129",
"length": 401.0
}
},
{
"signature_type": "Line",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/handler/Http2ContentDecompressor.java"
},
"deprecated": false,
"source": "https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841",
"id": "CVE-2026-55688-a0855412",
"signature_version": "v1",
"digest": {
"line_hashes": [
"253422009867771741918093294709443833936",
"21823556881918565729831316557690834190",
"200807070865387167329899158582355530211",
"165951157430060453609037063044464607822",
"243127565938855314629738460503586151779",
"38835864937427346434533419328346853548",
"211789229652080103893353352083681008055",
"211067571629286156262130661096154535348",
"169310331670907405300840003790325221546",
"246639459092083642337991774981336596908",
"262679696952574109914938962206240482992",
"155148766672275100170456853453053660701",
"66046542311741880596972445930701284355",
"339082823805500458195741288441200911285",
"75248862280756031098874135983234445238",
"195232628741288589062892926807167966964",
"87747181538119790827383794160318422298",
"58841950790330435721641527376671538677",
"58168414281291645047490332995332673751",
"192873722977191570932497273243623663648",
"316535605510127456067009711310198821746",
"3064464792799282636408746569122547800",
"151474661781890787207750511101211261279",
"60109057056103409219527658969925764716",
"289892182041330419924468107516807711875",
"339288572711192168998065562184850838077",
"175780009799240366521037586091420213299",
"98120590039491953231827780252070805152",
"124008729645157600096239573939786842830",
"206515462241069020336375013000402286187",
"302621602174065596021559585423071172169",
"47266374533292383957814598069560777856",
"221154439922329394869962360984488418110",
"138001601219251756982146144665480302945",
"295789269858419382702875547651710169817",
"149086078507665974006138624656466071812",
"67230770949975033532988540061836866594",
"68369968455449780043405025814676222215"
],
"threshold": 0.9
}
},
{
"signature_type": "Function",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/request/body/NettyInputStreamBody.java",
"function": "writeHttp2"
},
"deprecated": false,
"source": "https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841",
"id": "CVE-2026-55688-a53f59fd",
"signature_version": "v1",
"digest": {
"function_hash": "54814579453029277298933290366087221144",
"length": 860.0
}
},
{
"signature_type": "Function",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/channel/Http2ConnectionState.java",
"function": "drainPendingOpeners"
},
"deprecated": false,
"source": "https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841",
"id": "CVE-2026-55688-aa1c2dec",
"signature_version": "v1",
"digest": {
"function_hash": "316572681897388022559735775415777991421",
"length": 221.0
}
},
{
"signature_type": "Function",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/channel/ChannelManager.java",
"function": "updatePipelineForHttpsTunneling"
},
"deprecated": false,
"source": "https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841",
"id": "CVE-2026-55688-adeba581",
"signature_version": "v1",
"digest": {
"function_hash": "142941273132518517777387412915863503092",
"length": 916.0
}
},
{
"signature_type": "Function",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/request/NettyRequestSender.java",
"function": "initChannel"
},
"deprecated": false,
"source": "https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841",
"id": "CVE-2026-55688-b0ba7eb5",
"signature_version": "v1",
"digest": {
"function_hash": "152627523885473382999297957106370734959",
"length": 235.0
}
},
{
"signature_type": "Line",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/NettyResponseFuture.java"
},
"deprecated": false,
"source": "https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841",
"id": "CVE-2026-55688-b3d822c4",
"signature_version": "v1",
"digest": {
"line_hashes": [
"301956855787272313753580825010319499108",
"19240583457449598116401706929992483141",
"133327520452860534552884835513553529050",
"309749709202644576849103901163942077183",
"254328589927841818785202250926674449083",
"111637756446063258543527580174167768335",
"335775442849151416221020333576273558609",
"241857995198919394582963049324970961854",
"55421975553662860988155879425029351610",
"7015216382716676276731735401406984845",
"79077843914300977820377858763364321024"
],
"threshold": 0.9
}
},
{
"signature_type": "Function",
"target": {
"file": "client/src/test/java/org/asynchttpclient/CookieStoreTest.java",
"function": "runAllSequentiallyBecauseNotThreadSafe"
},
"deprecated": false,
"source": "https://github.com/asynchttpclient/async-http-client/commit/8e4069cf3c92abe099db5fb13378ac2fe9e1fd3b",
"id": "CVE-2026-55688-b4139664",
"signature_version": "v1",
"digest": {
"function_hash": "1775486200237590426810480674372578884",
"length": 504.0
}
},
{
"signature_type": "Function",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/handler/Http2Handler.java",
"function": "handleRead"
},
"deprecated": false,
"source": "https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841",
"id": "CVE-2026-55688-b8f901f7",
"signature_version": "v1",
"digest": {
"function_hash": "70024375161957820048956679583532554155",
"length": 884.0
}
},
{
"signature_type": "Function",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/request/NettyRequestSender.java",
"function": "releaseHttp2Stream"
},
"deprecated": false,
"source": "https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841",
"id": "CVE-2026-55688-bc4f4f0c",
"signature_version": "v1",
"digest": {
"function_hash": "170173469990056151281867852755957495536",
"length": 82.0
}
},
{
"signature_type": "Function",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/ssl/DefaultSslEngineFactory.java",
"function": "init"
},
"deprecated": false,
"source": "https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841",
"id": "CVE-2026-55688-be86fbf3",
"signature_version": "v1",
"digest": {
"function_hash": "288652667548671541065932174382739117124",
"length": 88.0
}
},
{
"signature_type": "Function",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/channel/ChannelManager.java",
"function": "addSslHandler"
},
"deprecated": false,
"source": "https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841",
"id": "CVE-2026-55688-c8c2aef3",
"signature_version": "v1",
"digest": {
"function_hash": "39901452766423235777448641038065482715",
"length": 622.0
}
},
{
"signature_type": "Function",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/request/NettyRequestSender.java",
"function": "writeHttp2Request"
},
"deprecated": false,
"source": "https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841",
"id": "CVE-2026-55688-cbcd491c",
"signature_version": "v1",
"digest": {
"function_hash": "42602855601569067265204874083358817992",
"length": 601.0
}
},
{
"signature_type": "Function",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/request/NettyRequestSender.java",
"function": "waitForHttp2Connection"
},
"deprecated": false,
"source": "https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841",
"id": "CVE-2026-55688-d18d91f3",
"signature_version": "v1",
"digest": {
"function_hash": "324043190269569083770660756981605951548",
"length": 495.0
}
},
{
"signature_type": "Function",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/NettyResponseFuture.java",
"function": "cancel"
},
"deprecated": false,
"source": "https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841",
"id": "CVE-2026-55688-d1c4a34c",
"signature_version": "v1",
"digest": {
"function_hash": "229807173759111656597472345573061885477",
"length": 477.0
}
},
{
"signature_type": "Function",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/request/NettyRequestSender.java",
"function": "pollPooledChannel"
},
"deprecated": false,
"source": "https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841",
"id": "CVE-2026-55688-d7bd175c",
"signature_version": "v1",
"digest": {
"function_hash": "219998368357020436009026373290079535152",
"length": 719.0
}
},
{
"signature_type": "Function",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/channel/ChannelManager.java",
"function": "createSslHandler"
},
"deprecated": false,
"source": "https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841",
"id": "CVE-2026-55688-db9cce9b",
"signature_version": "v1",
"digest": {
"function_hash": "98255007670129542502283808907247912474",
"length": 232.0
}
},
{
"signature_type": "Function",
"target": {
"file": "client/src/main/java/org/asynchttpclient/DefaultAsyncHttpClientConfig.java",
"function": "Builder"
},
"deprecated": false,
"source": "https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841",
"id": "CVE-2026-55688-e70b2fd3",
"signature_version": "v1",
"digest": {
"function_hash": "1048225234699166753492691210653490726",
"length": 3817.0
}
},
{
"signature_type": "Function",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/channel/Http2ConnectionState.java",
"function": "addPendingOpener"
},
"deprecated": false,
"source": "https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841",
"id": "CVE-2026-55688-ea428bdc",
"signature_version": "v1",
"digest": {
"function_hash": "318796423508470015881391960860577824919",
"length": 62.0
}
},
{
"signature_type": "Function",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/channel/NettyConnectListener.java",
"function": "onSuccess"
},
"deprecated": false,
"source": "https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841",
"id": "CVE-2026-55688-eac5118e",
"signature_version": "v1",
"digest": {
"function_hash": "291197188114682477072989390359047633747",
"length": 553.0
}
},
{
"signature_type": "Function",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/request/NettyRequestSender.java",
"function": "openHttp2Stream"
},
"deprecated": false,
"source": "https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841",
"id": "CVE-2026-55688-ec30e9ee",
"signature_version": "v1",
"digest": {
"function_hash": "87527761563858618585315895094570393172",
"length": 1323.0
}
},
{
"signature_type": "Line",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/request/body/NettyBodyBody.java"
},
"deprecated": false,
"source": "https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841",
"id": "CVE-2026-55688-f3006aaf",
"signature_version": "v1",
"digest": {
"line_hashes": [
"242250493679994314132694752406105459307",
"119478040034929904717843503902460816388",
"134348603463405165225569330065034686670",
"36524855504918587287391462379405395736",
"256395054393637088652297237964623648759",
"14229652230387917115241520886688258517",
"332877131765482460919564483971894765120",
"260319728483325690824025371090946294132",
"8167729403037745019186362661089878501",
"257297274013576164714634988435135976347",
"253407561940985876446532740106402830534",
"199410922507438605582281666571063367288",
"291204513207153732611749490711907003754",
"20671782582284635004328740780755218269",
"110461150340920749659314545303103296593",
"55985511606641729878256585685362477762",
"54646837197637628045059791542566127217",
"84421815256311749364751293628735357013",
"83372978786303156660319921499613743506",
"113586248847039417863105624086960614933",
"69965282108464580908061753219337873924",
"67484021554374919861489293245263843562",
"319712838391457202285641501114116732937",
"310585742961085316226268993131730799555",
"333596523726751583092974974276987955891",
"163360916862037725224150841418183737057",
"333261012389667240517260951996705560582",
"255069459670660148643073613385987983820",
"336421145927775472855118539803013243531",
"26425960058003503354921305046070411298",
"271480802128666347613602299773792263838",
"282162907031755965003701304198866918480",
"321445303095118471638049737102555304056",
"113094582079558898811707381134018087884"
],
"threshold": 0.9
}
},
{
"signature_type": "Line",
"target": {
"file": "client/src/main/java/org/asynchttpclient/DefaultAsyncHttpClientConfig.java"
},
"deprecated": false,
"source": "https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841",
"id": "CVE-2026-55688-f7b6ebae",
"signature_version": "v1",
"digest": {
"line_hashes": [
"37250148668781893677688852929490888031",
"42098258760845732861766939510360532657",
"293130276324970969182322825045917988399",
"249633957414014333654688369007814237463",
"10903647880959350635494872478899053602",
"217428166570322993561246166815820862930",
"281887064532740482514682474578539972637",
"151187886217374951065560215844126881229",
"208970667120066448979844198812379191795",
"190244808777808447776356142052708072672",
"23379863734576051468674882829166571023",
"292549917881359499085149703090944212235",
"308366662141558085355636832217359656496",
"78523267059901985938118301976824511901",
"241326004984977145611949860150287939028",
"105527658509263737787957823895956059284",
"252028528647425681805081087028629831649",
"86336583982701730651915806443604139920",
"42518029648170234868300853863883265845",
"40208564239498955381532483065730671989",
"247280657930761878727002856196116257559",
"244437857368844994313036078736894823810",
"187949788422487424378327764871688877180",
"209466043887905190467404193479573404028",
"285259223941689873344203193148983235856",
"302039803057849461859252627234002334743",
"273339601731315771290926167779292877819",
"330715845156034643597392718056633634241",
"317399691561048635243271890034540857007",
"92558811722547489860321439142210258693",
"184851907581933507553491923267536570603",
"207671729032803956052331912002697454346",
"269335363957515505815673079136712787359",
"54538496145409531116437717841046188880"
],
"threshold": 0.9
}
},
{
"signature_type": "Line",
"target": {
"file": "client/src/test/java/org/asynchttpclient/DefaultAsyncHttpClientConfigTest.java"
},
"deprecated": false,
"source": "https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841",
"id": "CVE-2026-55688-f832f001",
"signature_version": "v1",
"digest": {
"line_hashes": [
"100970644375370328899885056450758667511",
"180439485623435604290249790799564375231",
"298841151830067496670890058923806360760",
"72248671791205910254230015458684166070",
"257309318297310539071462747291560736103"
],
"threshold": 0.9
}
},
{
"signature_type": "Function",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/handler/Http2Handler.java",
"function": "readFailed"
},
"deprecated": false,
"source": "https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841",
"id": "CVE-2026-55688-fa060a1c",
"signature_version": "v1",
"digest": {
"function_hash": "330386850907958684717680561596712079894",
"length": 266.0
}
},
{
"signature_type": "Line",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/ssl/DefaultSslEngineFactory.java"
},
"deprecated": false,
"source": "https://github.com/asynchttpclient/async-http-client/commit/a374830195d5c36946cc73a8b1b91d1583514841",
"id": "CVE-2026-55688-fbcc9fa7",
"signature_version": "v1",
"digest": {
"line_hashes": [
"23865423823363754034163865227376553843",
"215383280142682198418852671107549614262",
"102616635088237724777698295441891774250",
"269507508914457197269750259759715682741",
"101714192232686759652488249851858843481",
"110900903761915517866512062627766998608",
"66362429832025525452751707074776091099",
"7965956526857806343016503713005375191",
"144688183678202265393994641819552934285",
"315027646457470740358482568931506958507",
"280169964249986877904898185982462269823",
"119289809656091413247904919996273636586",
"69003393923374637911735495586450954452",
"211309652618387707994569009849304050631",
"337107302786167809913407777581623019881",
"125553194831521486899570060042649537980",
"316575594660311788417519386797171987314",
"265346628001407167235551950345346044845",
"240831370177200269586611551038792811562",
"274908733958785329381987616772287683268",
"153632845636662769877008781333209418672",
"191338669696224725866968342614165153701",
"168225709066580610550332634304688394600",
"270123742940097343444166728583878790302",
"239970747944344907923037604010986513193",
"163187130037832030526419100395422458566",
"50176559341104836066420955951948399308",
"251076775898200296861632456772986055299",
"133817562732839592135290090927671815116",
"240294242952314574952125481508006254561",
"120173941925802665893915990413613000487",
"102140373605288975912096374265895059829"
],
"threshold": 0.9
}
}
]
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55688.json"