{"action":"Upgrade org.asynchttpclient:async-http-client to 2.16.1 (2.x) or 3.0.13 (3.x) or later.","affected":[{"fixed":"3.0.13","introduced":"3.0.0"},{"fixed":"2.16.1","introduced":"2.0.0"}],"component":"org.asynchttpclient:async-http-client","cve_ids":["CVE-2026-107280"],"ecosystem":"Maven","epss":0.00261,"exploited":false,"fixed_versions":["3.0.13","2.16.1"],"ghsa_id":"GHSA-f9m8-cv68-674w","id":"tcs_01M5N8VP5Z63WBN33BDR99E6YR","modified_at":"2026-10-08T16:45:19.478132339Z","published_at":"2026-10-08T16:30:53Z","references":["https://osv.dev/vulnerability/GHSA-f9m8-cv68-674w","https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-f9m8-cv68-674w","https://nvd.nist.gov/vuln/detail/CVE-2026-107280","https://github.com/AsyncHttpClient/async-http-client/commit/330267895fe0bdb41bbd027ea6b151d38ee7c23d","https://github.com/AsyncHttpClient/async-http-client/commit/d1f0ccec417092098d40242fee7dfac84bb3c21f","https://github.com/AsyncHttpClient/async-http-client","https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-2.16.1","https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.13"],"severity":{"label":"medium","score":6.9},"sources":[{"source":"osv","source_id":"GHSA-f9m8-cv68-674w","url":"https://osv.dev/vulnerability/GHSA-f9m8-cv68-674w"},{"source":"nvd","source_id":"CVE-2026-107280","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107280"}],"summary":"AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.uk"}