The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. In versions from 2.0.0 prior to 2.16.0 and from 3.0.0.Beta1 prior to 3.0.11, ThreadSafeCookieStore stored a cookie under the value of its Domain attribute without verifying that the responding host is allowed to set a cookie for that domain, leading to a cookie tossing / cookie injection issue. A host the client connects to can therefore plant a cookie scoped to an unrelated domain, and the client will then send that cookie on later requests to that domain. Applications that use a single AsyncHttpClient instance - and thus the default, shared CookieStore - to reach both an attacker-influenced host and a trusted host are impacted. This issue has been fixed in versions 2.16.0 and 3.0.11.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-8655-1 advisory.

    It was discovered that AsyncHttpClient did not properly verify that the responding host was allowed to set     cookies for a given domain in its ThreadSafeCookieStore. An attacker could use this to plant cookies     scoped to unrelated domains, which would then be sent on later requests to those domains.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and
    asynchronously process HTTP responses. In versions from 2.0.0 prior to 2.16.0 and from 3.0.0.Beta1 prior
    to 3.0.11, ThreadSafeCookieStore stored a cookie under the value of its Domain attribute without verifying
    that the responding host is allowed to set a cookie for that domain, leading to a cookie tossing / cookie
    injection issue. A host the client connects to can therefore plant a cookie scoped to an unrelated domain,
    and the client will then send that cookie on later requests to that domain. Applications that use a single
    AsyncHttpClient instance - and thus the default, shared CookieStore - to reach both an attacker-influenced
    host and a trusted host are impacted. This issue has been fixed in versions 2.16.0 and 3.0.11.
    (CVE-2026-55688)

The remote Debian 11 / 12 host has a package installed that is affected by a vulnerability as referenced in the dla-4721 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4721-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                           Chris Lamb     August 06, 2026                               https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : async-http-client     Version        : 2.12.2-1+deb11u1     CVE ID         : CVE-2026-55688     Debian Bug     : 1141445

    It was discovered that there was a potential cookie injection     vulnerability in async-http-client, Java library used to make     asynchronous HTTP requests.

    CVE-2026-55688

        Prevent a potential cookie injection or cookie tossing         vulnerability. ThreadSafeCookieStore stored a cookie under the         value of its Domain attribute, without verifying that the         responding host is allowed to set a cookie for that domain,         therefore leading to cookie tossing/injection issues.

    For Debian 11 bullseye, this problem has been fixed in version     2.12.2-1+deb11u1.

    For Debian 12 bookworm, this problem has been fixed in version     2.12.3-1+deb12u1.

    We recommend that you upgrade your async-http-client packages.

    For the detailed security status of async-http-client please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/async-http-client

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and     asynchronously process HTTP responses. In versions from 2.0.0 prior to 2.16.0 and from 3.0.0.Beta1 prior     to 3.0.11, ThreadSafeCookieStore stored a cookie under the value of its Domain attribute without verifying     that the responding host is allowed to set a cookie for that domain, leading to a cookie tossing / cookie     injection issue. A host the client connects to can therefore plant a cookie scoped to an unrelated domain,     and the client will then send that cookie on later requests to that domain. Applications that use a single     AsyncHttpClient instance - and thus the default, shared CookieStore - to reach both an attacker-influenced     host and a trusted host are impacted. This issue has been fixed in versions 2.16.0 and 3.0.11.
    (CVE-2026-55688)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
365434	Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : AsyncHttpClient vulnerability (USN-8655-1)	Nessus	Ubuntu Local Security Checks	Local	medium
460956	Echo: async-http-client, org.asynchttpclient:async-http-client: security update to 2.16.0	Tenable Cloud Security	Echo Local Security Checks	Local	medium
460956	Echo: async-http-client, org.asynchttpclient:async-http-client: security update to 2.16.0	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
333111	Debian dla-4721 : libasync-http-client-java - security update	Nessus	Debian Local Security Checks	Local	medium
324757	Linux Distros Unpatched Vulnerability : CVE-2026-55688	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-55688

medium

Tenable Plugins

medium

medium

medium

medium

medium