The AsyncHttpClient library's ThreadSafeCookieStore improperly stores cookies based solely on their Domain attribute without validating that the responding host is permitted to set cookies for that domain. This flaw enables cookie tossing or cookie injection, where an attacker-controlled host can set cookies for unrelated domains. Consequently, the client may send these injected cookies to trusted domains in subsequent requests, potentially leading to unintended cookie sharing or session confusion. This affects versions >=2.0.0 <2.16.0 and 3.0.0.Beta1 up to but not including 3.0.11. The vulnerability has been addressed in AsyncHttpClient versions 2.16.0 and 3.0.11.

An attacker controlling a host that the client connects to can inject cookies scoped to unrelated domains into the client's cookie store. This may cause the client to send attacker-injected cookies to trusted domains, potentially leading to session confusion or other integrity issues. The CVSS score of 4.0 (medium) reflects that the vulnerability requires network access with high attack complexity and no privileges or user interaction, and impacts integrity without affecting confidentiality or availability.

Upgrade AsyncHttpClient to version 2.16.0 or later, or 3.0.11 or later, where this vulnerability is fixed. No other mitigations are indicated. Patch status is not explicitly stated in the vendor advisory content, but the description confirms the issue is fixed in these versions.