AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.uk

Impact The cookie store decides whether a Domain attribute may be accepted using only the domain-matching rule of RFC 6265 Section 5.1.3, which asks whether the request host is the domain or ends with a dot followed by it. Section 5.3 step 5, which additionally requires rejecting a Domain that is...

CVE-2026-107229

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.16.0 until 3.0.14, ThreadSafeCookieStore incompletely validates cookie Domain attributes. Missing private-section and default public-suffix rules, absent...

CVE-2026-107229 AsyncHttpClient: Incomplete origin checks in the default cookie store allow cookie tossing onto public-suffix and IP-address hosts

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.16.0 until 3.0.14, ThreadSafeCookieStore incompletely validates cookie Domain attributes. Missing private-section and default public-suffix rules, absent...

EUVD-2026-94590

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.16.0 until 3.0.14, ThreadSafeCookieStore incompletely validates cookie Domain attributes. Missing private-section and default public-suffix rules, absent...

CVE-2026-107229

Removed by vendor...

Rocky Linux 10.0 [CIQ] Security Update: libsoup3 / libsoup3-debuginfo / libsoup3-debugsource / etc Multiple Vulnerabilities (crlsa-2025_8128)

The Rocky Linux 10.0 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20258128 advisory. libsoup: Denial of Service attack to websocket server CVE-2025-32049 libsoup: Denial of service in server when client requests a large amount of...

CVE-2026-100725: Exposure of Sensitive Information to an Unauthorized Actor

http4k Maven artifact org.http4k:http4k-core before 6.48.0.0, 5.42.0.0, and 4.51.0.0 ships a BasicCookieStorage client-side cookie store used by ClientFilters.Cookies that does not enforce RFC 6265 scoping rules for the cookie domain, path, and Secure attributes. When a single BasicCookieStorage...

Improper Cookie Domain

Http4s is vulnerable to improper cookie domain. The vulnerability is due to unanchored substring checks instead of RFC 6265-compliant domain and path matching when attaching stored cookies, which allows an attacker to exploit an application’s attacker-influenced outbound request to obtain session...

Improper Validation Of Cookie Domain Attributes

Http4s is vulnerable to improper validation of cookie domain attributes. The vulnerability is due to the CookieJar client middleware accepting a response cookie’s Domain attribute without validating that it matches the response host, which allows an attacker controlling or compromising a server t...

CVE-2026-69214

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The CookieJar client middleware stores a response cookie’s Domain attribute without checking that it domain-matches the host that supplied the cookie or rejecting public suffixes. A malicious or compromised server...

CVE-2026-69214 Http4s: CookieJar middleware accepts arbitrary Set-Cookie domain

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The CookieJar client middleware stores a response cookie’s Domain attribute without checking that it domain-matches the host that supplied the cookie or rejecting public suffixes. A malicious or compromised server...

CVE-2026-69214 Http4s: CookieJar middleware accepts arbitrary Set-Cookie domain

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The CookieJar client middleware stores a response cookie’s Domain attribute without checking that it domain-matches the host that supplied the cookie or rejecting public suffixes. A malicious or compromised server...

CVE-2026-69214 Http4s: CookieJar middleware accepts arbitrary Set-Cookie domain

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The CookieJar client middleware stores a response cookie’s Domain attribute without checking that it domain-matches the host that supplied the cookie or rejecting public suffixes. A malicious or compromised server...

CVE-2026-69214: Session Fixation

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The CookieJar client middleware stores a response cookie’s Domain attribute without checking that it domain-matches the host that supplied the cookie or rejecting public suffixes. A malicious or compromised server...

Astra Linux – Vulnerability in curl

This flaw allows a malicious HTTP server to set “super cookies” using curl, which are then transmitted back to multiple origins beyond what is allowed or possible. This enables a site to set cookies that are then sent to different and unrelated sites and domains. The attack exploits a flaw in...

AZL-99882 CVE-2026-82209 affecting package tensorflow 2.16.1-11

When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a Set-Cookie header where the Domain attribute explicitly matches an origin host that is itself a public suffix e.g., Domain=co.uk set by co.uk. Instead of coercing it into a strict...

ALPINE-CVE-2026-82209

When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a Set-Cookie header where the Domain attribute explicitly matches an origin host that is itself a public suffix e.g., Domain=co.uk set by co.uk. Instead of coercing it into a strict...

AZL-99825 CVE-2026-82209 affecting package rust 1.75.0-30

When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a Set-Cookie header where the Domain attribute explicitly matches an origin host that is itself a public suffix e.g., Domain=co.uk set by co.uk. Instead of coercing it into a strict...

AZL-99783 CVE-2026-82209 affecting package cmake 3.30.3-15

When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a Set-Cookie header where the Domain attribute explicitly matches an origin host that is itself a public suffix e.g., Domain=co.uk set by co.uk. Instead of coercing it into a strict...

AZL-99804 CVE-2026-82209 affecting package mysql 8.0.46-1

When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a Set-Cookie header where the Domain attribute explicitly matches an origin host that is itself a public suffix e.g., Domain=co.uk set by co.uk. Instead of coercing it into a strict...