CVE catalog

CVE-2024-53990

async-http-client: CVE-2024-53990

[CVE catalog]

Severity
High · CVSS 8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.72% · Oct 25, 2026

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. When making any HTTP request, the automatically enabled and self-managed CookieStore (aka cookie jar) will silently replace explicitly defined Cookies with any that have the same name from the cookie jar. For services that operate with multiple users, this can result in one user's Cookie being used for another user's requests.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianasync-http-clientsid2.12.3-1vulnerable
Debianasync-http-clientbookworm2.12.3-1vulnerable
Debianasync-http-clientbookworm-security2.12.3-1+deb12u1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianasync-http-clientsourcesid(unfixed)not yet assignedNot reported[1089228]
Debianasync-http-clientsourcebookworm(unfixed)not yet assignedNot reported[1089228]

[Debian bug #1089228]

Notes

[bookworm] async-http-client: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libasync-http-client-java]Affected

    Source package: [async-http-client]

    Details (4)

    • 2.12.3-1 · all · bookworm

      Affected

      dsa · async-http-client · debian · bookworm; dsa · async-http-client · debian · 12

    • 2.12.3-1 · all · bookworm

      Affected

      dsa · async-http-client · debian · bookworm; dsa · async-http-client · debian · 12

    • 2.12.3-1+deb12u1 · all · bookworm-security

      Affected

      dsa · async-http-client · debian · bookworm; dsa · async-http-client · debian · 12

    • 2.12.3-1+deb12u1 · all · bookworm-security

      Affected

      dsa · async-http-client · debian · bookworm; dsa · async-http-client · debian · 12

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]