AsyncHttpClient’s ThreadSafeCookieStore accepts cookies without validating that the host sending the cookie is permitted to set a cookie for the domain specified in the cookie’s Domain attribute. This defect is a domain validation flaw (CWE‑1275) and also represents a cookie injection weakness (CWE‑346). The defect allows a server that the application contacts to plant a cookie for an unrelated domain, and the library will store it. Subsequent requests to that domain will automatically include the forged cookie. This creates an unauthorized cookie injection vulnerability.

The impacted product is AsyncHttpClient’s async‑http‑client library. Versions 2.0.0 through 2.15.9 and 3.0.0.Beta1 through 3.0.10 are affected. Applications that use a single AsyncHttpClient instance—and share the default CookieStore—between an attacker‑controlled host and a trusted host are at risk. The fix was shipped in 2.16.0 and 3.0.11.

The CVSS score of 4.0 denotes moderate severity, and the EPSS score of less than 1% signals a very low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Likely, an attacker would need to persuade the Java application to communicate with a malicious server that returns a cookie with a foreign Domain attribute. Once the cookie is stored, it will be sent on subsequent requests to the unsuspecting domain. Based on the description, it is inferred that the forged cookie could interfere with authentication mechanisms that rely on domain‑scoped cookies, potentially enabling session hijacking or credential manipulation in vulnerable applications.