The AsyncHttpClient library stores Cookie headers without remembering whether the Set‑Cookie came over a secure channel. When a secure cookie is sent over plain HTTP, the library accepts it and allows insecure cookies with the same scope to overwrite or delete it. An attacker that can cause the application to receive a same‑site plaintext HTTP response can therefore plant, replace, or remove a cookie that should only appear over HTTPS. This can lead to session fixation, CSRF‑token replacement, or loss of other security‑relevant state. The vulnerability is a flaw in input validation and insecure state handling (CWE‑384, CWE‑693).

AsyncHttpClient library (AsyncHttpClient async-http-client). Versions from 2.1.0 up to and including 3.0.13 are vulnerable. The issue was fixed starting with version 3.0.14. Applications that depend on any of these vulnerable versions need to upgrade to 3.0.14 or later.

The CVSS score is 6.8, indicating a high severity. EPSS data is not available and the vulnerability is not in CISA KEV. The likely attack vector requires an attacker to control or inject a plaintext same‑site HTTP response to the application that uses AsyncHttpClient. This could occur through man‑in‑the‑middle attacks, compromised network infrastructure, or insecure host configurations. Once the attacker can deliver such a response, the vulnerability is exploitable with no authentication or privilege escalation on the server, providing a path to hijack or tamper with session state.