{"schema":"threatline.record/2","record":{"id":"CVE-2026-107280","aliases":["GHSA-f9m8-cv68-674w"],"summary":"AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.uk","details":"### Impact\nThe cookie store decides whether a `Domain` attribute may be accepted using only the domain-matching rule of RFC 6265 Section 5.1.3, which asks whether the request host is the domain or ends with a dot followed by it. Section 5.3 step 5, which additionally requires rejecting a `Domain` that is a public suffix, is not implemented anywhere in the client.\n\nSo a host under a multi-label public suffix can set a cookie for the suffix itself, and the store then hands it to every other host under that suffix:\n\n```\nattacker.co.uk  ->  Set-Cookie: SID=attacker-value; Domain=co.uk; Path=/\nbank.co.uk      ->  Cookie: SID=attacker-value\n```\n\n`Domain=uk` works the same way. The attacker needs only a site under the same suffix as the victim, which for suffixes such as `co.uk`, `com.au`, or `github.io` is trivially obtainable.\n\nDepending on what the application does with the cookie, this is session fixation, or it overwrites a session the victim site set, or it lets the attacker plant a value the victim site trusts.\n\n### Affected versions\n* 3.x: up to and including 3.0.12\n* 2.x: up to and including 2.16.0\n\n### Relationship to CVE-2026-55688\nCVE-2026-55688 (GHSA-m452-q8c9-rg2f) covered the direct form of this, where a host sets a `Domain` naming an unrelated host, and that form is genuinely fixed: `attacker.co.uk` can no longer set `Domain=bank.co.uk`, and this was verified as a control. What that fix did not add is the public suffix test, so setting `Domain=co.uk` still reaches `bank.co.uk`. This advisory covers only the residual.\n\n### Patches\nFixed in 3.0.13 on the 3.x line. The ICANN section of the Mozilla public suffix list is bundled with the client and a `Domain` matching it is rejected, honouring the list's wildcard and exception rules. The list is data and goes stale, so a suffix added upstream after a release is not recognised until the bundled copy is refreshed. The 2.x line is not yet fixed.\n\n### Workarounds\nDo not share one `CookieStore` across origins that are not mutually trusted. Supplying a `CookieStore` implementation that rejects `Domain` values which are public suffixes also avoids it.\n\n### Details\n`ThreadSafeCookieStore.domainsMatch` is `requestDomain.equals(cookieDomain) || requestDomain.endsWith('.' + cookieDomain)`. It is used both to accept a `Domain` on storage and to select cookies for a request, and neither call site consults a public suffix list. A search of the client for any public suffix or effective TLD handling returns nothing.","categories":["Libraries & packages"],"product":"org.asynchttpclient:async-http-client","vendor":"AsyncHttpClient","ecosystem":"maven","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-f9m8-cv68-674w","source_modified_at":"2026-10-08T16:30:54Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.asynchttpclient:async-http-client"},"range":">= 3.0.0, <= 3.0.12"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-f9m8-cv68-674w","source_modified_at":"2026-10-08T16:30:54Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.asynchttpclient:async-http-client"},"range":">= 2.0.0, <= 2.16.0"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-107280","source_modified_at":"2026-10-08T17:57:38.975Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"async-http-client","vendor":"AsyncHttpClient","versions":[{"version":">= 3.0.0, < 3.0.13","status":"affected"},{"version":">= 2.0.0, < 2.16.1","status":"affected"}],"defaultStatus":null},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-f9m8-cv68-674w","source_modified_at":"2026-10-08T16:45:19.478132339Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"org.asynchttpclient:async-http-client","purl":"pkg:maven/org.asynchttpclient/async-http-client"},"ranges":[{"events":[{"introduced":"3.0.0"},{"fixed":"3.0.13"}],"type":"ECOSYSTEM"}],"versions":["3.0.0","3.0.1","3.0.10","3.0.11","3.0.12","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-f9m8-cv68-674w","source_modified_at":"2026-10-08T16:45:19.478132339Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"org.asynchttpclient:async-http-client","purl":"pkg:maven/org.asynchttpclient/async-http-client"},"ranges":[{"events":[{"introduced":"2.0.0"},{"fixed":"2.16.1"}],"type":"ECOSYSTEM"}],"versions":["2.0.0","2.0.1","2.0.10","2.0.11","2.0.12","2.0.13","2.0.14","2.0.15","2.0.16","2.0.17","2.0.18","2.0.19","2.0.2","2.0.20","2.0.21","2.0.22","2.0.23","2.0.24","2.0.25","2.0.26","2.0.27","2.0.28","2.0.29","2.0.3","2.0.30","2.0.31","2.0.32","2.0.33","2.0.34","2.0.35","2.0.36","2.0.37","2.0.38","2.0.39","2.0.4","2.0.40","2.0.5","2.0.6","2.0.7","2.0.8","2.0.9","2.1.0","2.1.0-RC1","2.1.0-RC2","2.1.0-RC3","2.1.0-RC4","2.1.0-alpha1","2.1.0-alpha10","2.1.0-alpha11","2.1.0-alpha12"]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-f9m8-cv68-674w","source_modified_at":"2026-10-08T16:30:54Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.asynchttpclient:async-http-client"},"version":"3.0.13"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-f9m8-cv68-674w","source_modified_at":"2026-10-08T16:30:54Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.asynchttpclient:async-http-client"},"version":"2.16.1"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-f9m8-cv68-674w","source_modified_at":"2026-10-08T16:45:19.478132339Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"org.asynchttpclient:async-http-client","purl":"pkg:maven/org.asynchttpclient/async-http-client"},"version":"3.0.13"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-f9m8-cv68-674w","source_modified_at":"2026-10-08T16:45:19.478132339Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"org.asynchttpclient:async-http-client","purl":"pkg:maven/org.asynchttpclient/async-http-client"},"version":"2.16.1"}],"cvss":6.9,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.0026,"percentile":0.16824,"score_date":"2026-10-23"},"published_at":"2026-10-07T21:15:13.870Z","modified_at":"2026-10-08T17:57:38.975Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-f9m8-cv68-674w","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-08T16:30:54Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-107280","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-08T17:57:38.975Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-f9m8-cv68-674w","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-08T16:45:19.478132339Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107280","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-f9m8-cv68-674w","tags":["x_refsource_CONFIRM"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107280","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://github.com/AsyncHttpClient/async-http-client/commit/330267895fe0bdb41bbd027ea6b151d38ee7c23d","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/AsyncHttpClient/async-http-client/commit/d1f0ccec417092098d40242fee7dfac84bb3c21f","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-2.16.1","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.13","tags":["x_refsource_MISC"]},{"url":"https://github.com/advisories/GHSA-f9m8-cv68-674w","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-08T15:26:08.656292Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-08T17:57:38.975Z","content_hash":"1f3d1483427226a8f09a28a0e9595d244eb375ad8f3fbe5664aba8f557dfa0c1"}}