{"action":"Upgrade org.asynchttpclient:async-http-client to 3.0.14 or later.","affected":[{"fixed":"3.0.14","introduced":"3.0.0"},{"introduced":"2.1.0","last_affected":"2.16.1"}],"component":"org.asynchttpclient:async-http-client","cve_ids":["CVE-2026-107226"],"ecosystem":"Maven","epss":0.00294,"exploited":false,"fixed_versions":["3.0.14"],"ghsa_id":"GHSA-p2jm-6hj6-9rjg","id":"tcs_01M5N9672FMFF820Q1NMEPZ7YQ","modified_at":"2026-10-08T17:00:11.085978299Z","published_at":"2026-10-08T16:49:59Z","references":["https://osv.dev/vulnerability/GHSA-p2jm-6hj6-9rjg","https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-p2jm-6hj6-9rjg","https://github.com/AsyncHttpClient/async-http-client/commit/6ec7ee45034d154f502852a962d2891746fb82c1","https://github.com/AsyncHttpClient/async-http-client","https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.14"],"severity":{"label":"medium","score":6.8},"sources":[{"source":"osv","source_id":"GHSA-p2jm-6hj6-9rjg","url":"https://osv.dev/vulnerability/GHSA-p2jm-6hj6-9rjg"}],"summary":"AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPS"}