What is the CVSS score of CVE-2026-55688?

CVE-2026-55688 has a CVSS 3.1 base score of 4.0 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-55688?

Yes, a patch is available for CVE-2026-55688. Update the affected software to the latest version immediately.

AsyncHttpClient CVE-2026-55688

EUVD-2026-41134 MEDIUM

Sensitive Cookie with Improper SameSite Attribute (CWE-1275)

2026-07-01 GitHub_M

GHSA-m452-q8c9-rg2f

Code Injection Java Async Http Client

4.0

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

4.0 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N

vuln.today AI

4.0 MEDIUM

AC:H reflects the required shared-CookieStore architecture; PR:N because the attacker only controls a responding HTTP server; S:C because injected cookie crosses to a distinct trusted domain; I:L for cookie-level integrity tampering with no confidentiality or availability impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N

Red Hat

4.0 MEDIUM

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Jul 01, 2026 - 21:02 EUVD

Analysis Generated

Jul 01, 2026 - 20:21 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

5 maven packages depend on org.asynchttpclient:async-http-client (1 direct, 4 indirect)

Ecosystem-wide dependent count for version 3.0.0.Beta1.

DescriptionCVE.org

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. In versions from 2.0.0 prior to 2.16.0 and from 3.0.0.Beta1 prior to 3.0.11, ThreadSafeCookieStore stored a cookie under the value of its Domain attribute without verifying that the responding host is allowed to set a cookie for that domain, leading to a cookie tossing / cookie injection issue. A host the client connects to can therefore plant a cookie scoped to an unrelated domain, and the client will then send that cookie on later requests to that domain. Applications that use a single AsyncHttpClient instance - and thus the default, shared CookieStore - to reach both an attacker-influenced host and a trusted host are impacted. This issue has been fixed in versions 2.16.0 and 3.0.11.

AnalysisAI

Cookie tossing in AsyncHttpClient (AHC) library allows a malicious HTTP server to plant cookies scoped to an unrelated trusted domain, affecting versions 2.0.0-2.15.x and 3.0.0.Beta1-3.0.10. ThreadSafeCookieStore accepts and stores a cookie's Domain attribute value without verifying that the responding host is authorised to set cookies for that domain, so any server the client contacts can inject a cookie that AHC will automatically forward to the targeted domain on subsequent requests. Java applications sharing a single AHC instance - and therefore its default shared CookieStore - across calls to both attacker-influenced and trusted hosts are the primary attack surface; no public exploit has been identified at time of analysis, and vendor-released fixes are available in 2.16.0 and 3.0.11.

Technical ContextAI

AsyncHttpClient (CPE: cpe:2.3:a:asynchttpclient:async-http-client) is a Java library providing non-blocking, asynchronous HTTP request execution. Its ThreadSafeCookieStore class is the default, shared CookieStore used when one AHC instance serves multiple HTTP connections. RFC 6265 mandates that an HTTP client reject any Set-Cookie header whose Domain attribute is not a registrable-domain suffix of the responding host's FQDN before persisting the cookie; AHC's ThreadSafeCookieStore omits this origin check entirely, storing the cookie under whatever Domain value the server supplies. The assigned root cause is CWE-1275 (Sensitive Cookie with Improper SameSite Attribute class), reflecting a failure to enforce cookie-scope boundaries at the storage layer. Because the CookieStore is shared across all connections within the same AHC instance, a cookie accepted from a rogue server persists and is transmitted to any later request whose host matches the injected Domain value, crossing application trust boundaries without any further attacker interaction.

RemediationAI

Upgrade async-http-client to version 2.16.0 (for the 2.x stable line) or 3.0.11 (for the 3.x pre-release line), both of which enforce RFC 6265-compliant domain-origin validation in ThreadSafeCookieStore per the vendor advisory at https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-m452-q8c9-rg2f. For applications that cannot upgrade immediately, create a distinct AsyncHttpClient instance for each trust domain rather than sharing one instance across trusted and untrusted hosts; this eliminates the shared CookieStore, breaking the injection path at the cost of increased object allocation and connection-pool fragmentation. A second compensating control is to supply a custom CookieStore implementation that rejects any Set-Cookie header whose Domain attribute is not a suffix of the responding host, restoring the RFC 6265 validation that the default store omits; this preserves a single AHC instance but requires a code change. Disabling cookie storage entirely (by configuring a no-op CookieStore) is the most aggressive workaround and eliminates the attack surface completely, though it breaks any functionality that depends on cookie-based session continuity.