{"action":"Upgrade org.asynchttpclient:async-http-client to 2.12.4 (2.x) or 3.0.1 (3.x) or later.","affected":[{"fixed":"2.12.4","introduced":"2.1.0"},{"fixed":"3.0.1","introduced":"3.0.0.Beta1"}],"component":"org.asynchttpclient:async-http-client","cve_ids":["CVE-2024-53990"],"ecosystem":"Maven","epss":0.00722,"exploited":false,"fixed_versions":["2.12.4","3.0.1"],"ghsa_id":"GHSA-mfj5-cf8g-g2fv","id":"tcs_01M5N950Y2RWWRTP49NJ3RVS50","modified_at":"2026-09-10T03:50:21.642131422Z","published_at":"2024-12-02T20:04:43Z","references":["https://osv.dev/vulnerability/GHSA-mfj5-cf8g-g2fv","https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-mfj5-cf8g-g2fv","https://nvd.nist.gov/vuln/detail/CVE-2024-53990","https://github.com/AsyncHttpClient/async-http-client/issues/1964","https://github.com/AsyncHttpClient/async-http-client/pull/2033","https://github.com/AsyncHttpClient/async-http-client/commit/d5a83362f7aed81b93ebca559746ac9be0f95425","https://github.com/AsyncHttpClient/async-http-client","https://github.com/AsyncHttpClient/async-http-client/blob/main/CHANGES.md#from-20-to-21"],"severity":{"label":"critical"},"sources":[{"source":"osv","source_id":"GHSA-mfj5-cf8g-g2fv","url":"https://osv.dev/vulnerability/GHSA-mfj5-cf8g-g2fv"}],"summary":"AsyncHttpClient (AHC) library's `CookieStore` replaces explicitly defined `Cookie`s"}