The AsyncHttpClient library suffers from a cookie tossing/cookie injection vulnerability due to ThreadSafeCookieStore storing cookies without verifying the domain authorization of the responding host. This flaw allows an attacker-controlled host to set cookies for unrelated domains, which the client will send on later requests, potentially leading to unintended cookie sharing across domains. The vulnerability affects versions from 2.0.0 up to but not including 2.16.0 and from 3.0.0.Beta1 up to but not including 3.0.11. The issue is resolved in versions 2.16.0 and 3.0.11.

An attacker controlling a host that the client connects to can inject cookies scoped to unrelated domains into the client's cookie store. This may cause the client to send attacker-injected cookies to trusted domains, potentially leading to session confusion or other unintended behaviors. The CVSS score is 4.0 (medium severity) with network attack vector, high attack complexity, no privileges required, no user interaction, and impact limited to integrity.

Upgrade AsyncHttpClient to version 2.16.0 or later, or 3.0.11 or later, where this vulnerability is fixed. There is no indication of alternative mitigations or temporary fixes. Patch status is not explicitly confirmed in the vendor advisory, but the description states the issue is fixed in these versions.