CVE-2026-107229

The AsyncHttpClient (AHC) library for Java applications contains a vulnerability in the ThreadSafeCookieStore component. From version 2.16.0 until 3.0.14 , the library incompletely validates cookie Domain attributes due to missing private-section and public-suffix rules, lack of A-label normaliza...

CVE-2026-107228 AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader (Bypass of CVE-2024-53990 Fix)

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 3.0.14, the enabled-by-default cookie store replaces a Cookie header explicitly supplied through setHeader or addHeader whenever the store contribut...

CVE-2026-107228

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 3.0.14, the enabled-by-default cookie store replaces a Cookie header explicitly supplied through setHeader or addHeader whenever the store contribut...

CVE-2026-107228 AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader (Bypass of CVE-2024-53990 Fix)

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 3.0.14, the enabled-by-default cookie store replaces a Cookie header explicitly supplied through setHeader or addHeader whenever the store contribut...

CVE-2026-107228

The AsyncHttpClient (AHC) library versions 2.1.0 through 3.0.14 contains a vulnerability where the default cookie store silently overrides explicit Cookie headers provided via setHeader or addHeader. In shared client environments, this allows cookies from one user's session to replace another use...

CVE-2026-107228 AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader (Bypass of CVE-2024-53990 Fix)

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 3.0.14, the enabled-by-default cookie store replaces a Cookie header explicitly supplied through setHeader or addHeader whenever the store contribut...

CVE-2026-107228

Removed by vendor...

CVE-2026-107227

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.2.0 until 3.0.14, WebSocket permessage-deflate decompression is unbounded when compression is enabled. The inbound pipeline aggregates compressed frames befor...

CVE-2026-107227 AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabled

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.2.0 until 3.0.14, WebSocket permessage-deflate decompression is unbounded when compression is enabled. The inbound pipeline aggregates compressed frames befor...

CVE-2026-107227

The AsyncHttpClient (AHC) library is vulnerable to a denial of service (DoS) attack via a decompression bomb when WebSocket permessage-deflate decompression is enabled. In versions 2.2.0 until 3.0.14 , the inbound pipeline aggregates compressed frames before inflation, meaning webSocketMaxFrameSi...

CVE-2026-107227 AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabled

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.2.0 until 3.0.14, WebSocket permessage-deflate decompression is unbounded when compression is enabled. The inbound pipeline aggregates compressed frames befor...

CVE-2026-107227

Removed by vendor...

CVE-2026-107227 AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabled

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.2.0 until 3.0.14, WebSocket permessage-deflate decompression is unbounded when compression is enabled. The inbound pipeline aggregates compressed frames befor...

PT-2026-107711

Name of the Vulnerable Software and Affected Versions AsyncHttpClient versions prior to 3.0.13 AsyncHttpClient versions prior to 2.16.1 Description Cross-host request replay occurs when the current request is updated but the target request and related proxy context continue to point to the origin...

PT-2026-107683

Name of the Vulnerable Software and Affected Versions AsyncHttpClient versions prior to 3.0.13 Description In the AsyncHttpClient library, a peer offering only Digest qop=auth-int causes mutual-authentication verification to be skipped. This occurs because the computeExpectedRspAuth function in...

PT-2026-107684

Name of the Vulnerable Software and Affected Versions AsyncHttpClient versions prior to 3.0.13 AsyncHttpClient versions prior to 2.16.1 Description The ThreadSafeCookieStore component validates Domain attributes using domain matching but fails to reject public suffixes. This allows a host located...

CVE-2026-107227: Uncontrolled Resource Consumption

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.2.0 until 3.0.14, WebSocket permessage-deflate decompression is unbounded when compression is enabled. The inbound pipeline aggregates compressed frames befor...

CVE-2026-107228: Improper Authentication

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 3.0.14, the enabled-by-default cookie store replaces a Cookie header explicitly supplied through setHeader or addHeader whenever the store contribut...

PT-2026-107678

Name of the Vulnerable Software and Affected Versions AsyncHttpClient versions 2.1.0 through 3.0.13 Description The enabled-by-default cookie store in the AsyncHttpClient library replaces a Cookie header explicitly supplied through setHeader or addHeader whenever the store contributes any cookie...

PT-2026-107677

Name of the Vulnerable Software and Affected Versions AsyncHttpClient versions 2.2.0 through 3.0.13 Description WebSocket permessage-deflate decompression is unbounded when compression is enabled. The inbound pipeline aggregates compressed frames before the WebSocketClientCompressionHandler...