CVE-2026-107229
Description
A flaw was found in AsyncHttpClient. The library's cookie store incompletely validates domain attributes when processing HTTP cookies. A remote attacker controlling a server can exploit this vulnerability to store cookies that the client subsequently sends to unrelated domains. This allows cross-domain cookie injection, potentially exposing applications that share an HTTP client instance to session fixation attacks.
Statement
A flaw of moderate severity was found in the AsyncHttpClient (AHC) Java library, which is shipped in Red Hat JBoss Fuse 7. The library's default cookie store, ThreadSafeCookieStore, incompletely validates the Domain attribute of Set-Cookie headers: it omits private-section and default public-suffix rules, A-label normalization, locale-independent lowercasing, and numeric or IP host checks. As a result, a remote attacker who controls one origin can store a cookie that the client later sends to a different, unrelated origin (cross-domain cookie injection). Applications that share a single AsyncHttpClient instance and its cookie store across different trust domains can consequently receive attacker-injected cookies and may be exposed to session fixation. Red Hat rates this flaw MODERATE severity (CVSS 4.0, CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N), consistent with the upstream rating. Within the Red Hat portfolio, the affected async-http-client component appears only in Red Hat JBoss Fuse 7 (fuse-7-els-2 update stream). Because that stream is out of support scope, no Red Hat fix is planned for it, and applications running the affected component on that stream remain exposed to the residual cross-domain cookie injection risk.
Mitigation
Upstream documents the following workarounds: use a separate AsyncHttpClient instance per trust domain so that no cookie store spans multiple trust domains; disable the cookie store by calling setCookieStore(null); or provide a custom CookieStore implementation that applies complete cookie Domain attribute validation. Upstream fixed this issue in async-http-client 3.0.14, so upgrading to that version or later resolves the flaw. Note that upstream has stated the 2.x line is end of life and will not receive the fix.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4 | N/A | 4 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Changed | N/A | Changed |
| Confidentiality | None | N/A | None |
| Integrity Impact | Low | N/A | Low |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
cve.org: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
Understanding the Weakness (CWE)
Access Control,Other
Technical Impact: Gain Privileges or Assume Identity; Varies by Context
An attacker can access any functionality that is inadvertently accessible to the source.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
