{"items":[{"id":"NVI-00012024","kind":"vulnerability","title":"AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader (Bypass of CVE-2024-53990 Fix)","revision":3,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-2jwh-9rmr-j4xf","CVE-2026-107228"],"plain_summary":"GitHub lists this reviewed advisory for org.asynchttpclient:async-http-client, org.asynchttpclient:async-http-client. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-0734b0fd750b2a4e0e97a848b497e49f"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-08T16:50:04.000Z","value":"6.8 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-8beca9464079ccb28b2cead167613739"},{"kind":"CVSS","as_of":"2026-10-08T20:35:31.200Z","value":"6.8 MEDIUM (3.1)","meaning":"security-advisories@github.com severity; no combined Null risk score.","source_id":"sr-19aca6aea114a7b5200c7f2225d447c1"},{"kind":"EPSS","as_of":"2026-11-03T12:00:27.000Z","value":"0.301%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.22908. Missing scores are unknown.","source_id":"sr-0734b0fd750b2a4e0e97a848b497e49f"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-8beca9464079ccb28b2cead167613739","url":"https://github.com/advisories/GHSA-2jwh-9rmr-j4xf","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-2jwh-9rmr-j4xf","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T00:58:38.867Z"},{"id":"sr-19aca6aea114a7b5200c7f2225d447c1","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107228","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2026-107228","publisher":"NIST National Vulnerability Database","observed_at":"2026-11-03T09:58:21.903Z"},{"id":"sr-0734b0fd750b2a4e0e97a848b497e49f","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-107228","publisher":"FIRST EPSS","observed_at":"2026-11-03T17:44:07.774Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-8beca9464079ccb28b2cead167613739"],"technology":"org.asynchttpclient:async-http-client","known_exclusions":[],"conditions_summary":"### Impact\n\nWith the cookie store enabled, which is the default, a `Cookie` header that the caller sets on a request with `setHeader` or `addHeader` is thrown away whenever the store holds any cookie for the request's origin: the request's cookie list is written into that header afterwards and replaces it. CVE-2024-53990 fixed the same problem for cookies added with `addCookie`, but that fix works on the cookie list, and a header set directly never reaches it.\n\nThis is not limited to a cookie of the same name. A store cookie of any name erases the caller's header, so a request meant to carry the caller's session cookie goes out with only the store's cookies, and where the store has a cookie of the caller's name, the store's value is sent instead.\n\nIt matters most where one client acts for several users. An application that puts each user's session on the request itself, and shares one client and its default cookie store, sends one user's request with a session cookie the store took from a response to another user. The request runs as that other user, so a user of such an application can have their request served under someone else's session, or someone else's under theirs.\n\n### Aff","public_affected_ranges":[">= 3.0.0, <= 3.0.13"]},{"certainty":"source_listed","source_ids":["sr-8beca9464079ccb28b2cead167613739"],"technology":"org.asynchttpclient:async-http-client","known_exclusions":[],"conditions_summary":"### Impact\n\nWith the cookie store enabled, which is the default, a `Cookie` header that the caller sets on a request with `setHeader` or `addHeader` is thrown away whenever the store holds any cookie for the request's origin: the request's cookie list is written into that header afterwards and replaces it. CVE-2024-53990 fixed the same problem for cookies added with `addCookie`, but that fix works on the cookie list, and a header set directly never reaches it.\n\nThis is not limited to a cookie of the same name. A store cookie of any name erases the caller's header, so a request meant to carry the caller's session cookie goes out with only the store's cookies, and where the store has a cookie of the caller's name, the store's value is sent instead.\n\nIt matters most where one client acts for several users. An application that puts each user's session on the request itself, and shares one client and its default cookie store, sends one user's request with a session cookie the store took from a response to another user. The request runs as that other user, so a user of such an application can have their request served under someone else's session, or someone else's under theirs.\n\n### Aff","public_affected_ranges":[">= 2.1.0, <= 2.16.1"]}],"null_published_at":"2026-11-04T10:04:41.554Z","source_updated_at":"2026-10-08T16:50:04.000Z","source_disclosed_at":"2026-10-08T16:50:03.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-11-01T00:58:38.867Z"},{"id":"NVI-00012024","kind":"vulnerability","title":"AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader (Bypass of CVE-2024-53990 Fix)","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-2jwh-9rmr-j4xf","CVE-2026-107228"],"plain_summary":"GitHub lists this reviewed advisory for org.asynchttpclient:async-http-client, org.asynchttpclient:async-http-client. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-19aca6aea114a7b5200c7f2225d447c1"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-08T16:50:04.000Z","value":"6.8 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-8beca9464079ccb28b2cead167613739"},{"kind":"CVSS","as_of":"2026-10-08T20:35:31.200Z","value":"6.8 MEDIUM (3.1)","meaning":"security-advisories@github.com severity; no combined Null risk score.","source_id":"sr-19aca6aea114a7b5200c7f2225d447c1"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-8beca9464079ccb28b2cead167613739","url":"https://github.com/advisories/GHSA-2jwh-9rmr-j4xf","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-2jwh-9rmr-j4xf","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T00:58:38.867Z"},{"id":"sr-19aca6aea114a7b5200c7f2225d447c1","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107228","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2026-107228","publisher":"NIST National Vulnerability Database","observed_at":"2026-11-03T09:58:21.903Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-8beca9464079ccb28b2cead167613739"],"technology":"org.asynchttpclient:async-http-client","known_exclusions":[],"conditions_summary":"### Impact\n\nWith the cookie store enabled, which is the default, a `Cookie` header that the caller sets on a request with `setHeader` or `addHeader` is thrown away whenever the store holds any cookie for the request's origin: the request's cookie list is written into that header afterwards and replaces it. CVE-2024-53990 fixed the same problem for cookies added with `addCookie`, but that fix works on the cookie list, and a header set directly never reaches it.\n\nThis is not limited to a cookie of the same name. A store cookie of any name erases the caller's header, so a request meant to carry the caller's session cookie goes out with only the store's cookies, and where the store has a cookie of the caller's name, the store's value is sent instead.\n\nIt matters most where one client acts for several users. An application that puts each user's session on the request itself, and shares one client and its default cookie store, sends one user's request with a session cookie the store took from a response to another user. The request runs as that other user, so a user of such an application can have their request served under someone else's session, or someone else's under theirs.\n\n### Aff","public_affected_ranges":[">= 3.0.0, <= 3.0.13"]},{"certainty":"source_listed","source_ids":["sr-8beca9464079ccb28b2cead167613739"],"technology":"org.asynchttpclient:async-http-client","known_exclusions":[],"conditions_summary":"### Impact\n\nWith the cookie store enabled, which is the default, a `Cookie` header that the caller sets on a request with `setHeader` or `addHeader` is thrown away whenever the store holds any cookie for the request's origin: the request's cookie list is written into that header afterwards and replaces it. CVE-2024-53990 fixed the same problem for cookies added with `addCookie`, but that fix works on the cookie list, and a header set directly never reaches it.\n\nThis is not limited to a cookie of the same name. A store cookie of any name erases the caller's header, so a request meant to carry the caller's session cookie goes out with only the store's cookies, and where the store has a cookie of the caller's name, the store's value is sent instead.\n\nIt matters most where one client acts for several users. An application that puts each user's session on the request itself, and shares one client and its default cookie store, sends one user's request with a session cookie the store took from a response to another user. The request runs as that other user, so a user of such an application can have their request served under someone else's session, or someone else's under theirs.\n\n### Aff","public_affected_ranges":[">= 2.1.0, <= 2.16.1"]}],"null_published_at":"2026-11-03T10:03:31.374Z","source_updated_at":"2026-10-08T16:50:04.000Z","source_disclosed_at":"2026-10-08T16:50:03.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-11-01T00:58:38.867Z"},{"id":"NVI-00012024","kind":"vulnerability","title":"AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader (Bypass of CVE-2024-53990 Fix)","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-2jwh-9rmr-j4xf","CVE-2026-107228"],"plain_summary":"GitHub lists this reviewed advisory for org.asynchttpclient:async-http-client, org.asynchttpclient:async-http-client. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-8beca9464079ccb28b2cead167613739"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-08T16:50:04.000Z","value":"6.8 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-8beca9464079ccb28b2cead167613739"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-8beca9464079ccb28b2cead167613739","url":"https://github.com/advisories/GHSA-2jwh-9rmr-j4xf","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-2jwh-9rmr-j4xf","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T00:58:38.867Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-8beca9464079ccb28b2cead167613739"],"technology":"org.asynchttpclient:async-http-client","known_exclusions":[],"conditions_summary":"### Impact\n\nWith the cookie store enabled, which is the default, a `Cookie` header that the caller sets on a request with `setHeader` or `addHeader` is thrown away whenever the store holds any cookie for the request's origin: the request's cookie list is written into that header afterwards and replaces it. CVE-2024-53990 fixed the same problem for cookies added with `addCookie`, but that fix works on the cookie list, and a header set directly never reaches it.\n\nThis is not limited to a cookie of the same name. A store cookie of any name erases the caller's header, so a request meant to carry the caller's session cookie goes out with only the store's cookies, and where the store has a cookie of the caller's name, the store's value is sent instead.\n\nIt matters most where one client acts for several users. An application that puts each user's session on the request itself, and shares one client and its default cookie store, sends one user's request with a session cookie the store took from a response to another user. The request runs as that other user, so a user of such an application can have their request served under someone else's session, or someone else's under theirs.\n\n### Aff","public_affected_ranges":[">= 3.0.0, <= 3.0.13"]},{"certainty":"source_listed","source_ids":["sr-8beca9464079ccb28b2cead167613739"],"technology":"org.asynchttpclient:async-http-client","known_exclusions":[],"conditions_summary":"### Impact\n\nWith the cookie store enabled, which is the default, a `Cookie` header that the caller sets on a request with `setHeader` or `addHeader` is thrown away whenever the store holds any cookie for the request's origin: the request's cookie list is written into that header afterwards and replaces it. CVE-2024-53990 fixed the same problem for cookies added with `addCookie`, but that fix works on the cookie list, and a header set directly never reaches it.\n\nThis is not limited to a cookie of the same name. A store cookie of any name erases the caller's header, so a request meant to carry the caller's session cookie goes out with only the store's cookies, and where the store has a cookie of the caller's name, the store's value is sent instead.\n\nIt matters most where one client acts for several users. An application that puts each user's session on the request itself, and shares one client and its default cookie store, sends one user's request with a session cookie the store took from a response to another user. The request runs as that other user, so a user of such an application can have their request served under someone else's session, or someone else's under theirs.\n\n### Aff","public_affected_ranges":[">= 2.1.0, <= 2.16.1"]}],"null_published_at":"2026-11-01T01:03:56.623Z","source_updated_at":"2026-10-08T16:50:04.000Z","source_disclosed_at":"2026-10-08T16:50:03.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-01T00:58:38.867Z"}],"next_cursor":null,"snapshot_revision":"42594"}