AsyncHttpClient EUVD-2026-94639

Exploitation requires an AsyncHttpClient application (versions prior to 3.0.13 or 2.16.1) that shares a single ThreadSafeCookieStore across requests to multiple hosts sharing a registry-level public suffix (e.g. co.uk), and an attacker who controls a host beneath that suffix to emit a Set-Cookie whose Domain attribute names the public suffix itself. Limiting factors: the client must actually contact both the attacker-controlled host and a victim host under the same suffix using the same cookie store; impact is restricted to integrity (cookie inject/overwrite) with no direct confidentiality or availability loss; CVSS marks High attack complexity (AC:H) and a present Attack Requirement (AT:P), reflecting the non-default, scenario-dependent prerequisites. No authentication is required (PR:N) and no user interaction is required (UI:N).

This is a genuine but moderate-severity integrity flaw, best characterized as a cross-origin cookie injection (public-suffix) weakness, not a high-urgency priority. The vendor-supplied CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N) scores 6.9 (Medium): network-reachable and unauthenticated, but gated by both High attack complexity and a present Attack Requirement (AT:P), reflecting that exploitation depends on specific runtime circumstances - an application sharing a ThreadSafeCookieStore across requests to multiple hosts that fall under a common public suffix, with the attacker controlling one host beneath that suffix. Impact is confined to subsequent-system integrity (SI:H) with no confidentiality or availability impact (VC:N/VI:N/VA:N), consistent with cookie overwrite/injection rather than code execution. No EPSS score, CISA KEV listing, or public exploit was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the AC:H and AT:P metrics plus the library-dependency nature argue against opportunistic mass exploitation. Note a signal conflict: the input Tag 'Code Injection' and the loose use of CWE do not match the actual weakness (CWE-1275-style improper cookie handling / public-suffix cookie injection) - this is NOT remote code execution, and the 'Code Injection' label overstates the impact. Prioritize patching in applications that reuse one AHC cookie store across many destination hosts, but this is not a drop-everything issue.

An application uses AsyncHttpClient with a shared ThreadSafeCookieStore to call several services that live under a common public suffix (for example several *.co.uk sites). An attacker who controls any host beneath that suffix returns a Set-Cookie with Domain=co.uk; AHC accepts it because it does not reject public suffixes, then replays that cookie on later requests to unrelated co.uk hosts, overwriting or injecting session-relevant cookie values. No public exploit code was identified in the provided data, and High attack complexity plus the attacker-controlled-host requirement limit practicality.