The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, ThreadSafeCookieStore validates Domain attributes with domain matching but does not reject public suffixes. A host beneath a suffix such as co.uk can set a cookie for that suffix, after which the shared cookie store sends it to unrelated hosts under the suffix. This can inject or overwrite session-relevant cookie values across origins. This issue is fixed in versions 3.0.13 and 2.16.1.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and
    asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, ThreadSafeCookieStore validates Domain
    attributes with domain matching but does not reject public suffixes. A host beneath a suffix such as co.uk
    can set a cookie for that suffix, after which the shared cookie store sends it to unrelated hosts under
    the suffix. This can inject or overwrite session-relevant cookie values across origins. This issue is
    fixed in versions 3.0.13 and 2.16.1. (CVE-2026-107280)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and     asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, ThreadSafeCookieStore validates Domain     attributes with domain matching but does not reject public suffixes. A host beneath a suffix such as co.uk     can set a cookie for that suffix, after which the shared cookie store sends it to unrelated hosts under     the suffix. This can inject or overwrite session-relevant cookie values across origins. This issue is     fixed in versions 3.0.13 and 2.16.1. (CVE-2026-107280)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
474140	Echo: org.asynchttpclient:async-http-client: security update to 2.16.1	Tenable Cloud Security	Echo Local Security Checks	Local	medium
474140	Echo: org.asynchttpclient:async-http-client: security update to 2.16.1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
473896	SCA: security update for org.asynchttpclient:async-http-client (GHSA-f9m8-cv68-674w)	Tenable Cloud Security	SCA Checks	Local	medium
473896	SCA: security update for org.asynchttpclient:async-http-client (GHSA-f9m8-cv68-674w)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
364231	Linux Distros Unpatched Vulnerability : CVE-2026-107280	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-107280

medium

Tenable Plugins

medium

medium

medium

medium

medium