Bug 2549856 (CVE-2026-107226)

Summary: CVE-2026-107226 org.asynchttpclient/async-http-client: AsyncHttpClient: Session fixation via unencrypted HTTP cookie overwriting
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: gmalinko, janstey, pdelbell, rstepani
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in AsyncHttpClient. The default cookie store fails to track whether cookies were received over an encrypted connection, allowing unencrypted HTTP responses to plant, overwrite, or delete cookies designated with the Secure attribute. A remote attacker capable of returning an unencrypted response can exploit this vulnerability to alter cookie states sent to secure HTTPS destinations. This can enable session fixation attacks, unauthorized Cross-Site Request Forgery (CSRF) token replacement, or the loss of security-critical state.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-12 18:42:00 UTC 
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 3.0.14, the default ThreadSafeCookieStore does not retain whether a Set-Cookie response used a secure transport. It accepts Secure cookies received over plaintext and permits insecure cookies to overlay or delete existing Secure cookies with matching scope. An attacker controlling a plaintext same-site response can consequently plant, replace, or remove cookie state later sent to an HTTPS origin, enabling session fixation, CSRF-token replacement, or loss of security-relevant state. This issue is fixed in version 3.0.14.