Debian alert DLA-4721-1 (async-http-client)

From:
             
 
Chris Lamb <lamby@debian.org>
To:
             
 
debian-lts-announce@lists.debian.org
Subject:
             
 
[SECURITY] [DLA 4721-1] async-http-client security update
Date:
             
 
Thu, 06 Aug 2026 09:56:13 -0700
Message-ID:
             
 
<178603166664.430190.6404959235746615466@bigcat>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

- -------------------------------------------------------------------------
Debian LTS Advisory DLA-4721-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                           Chris Lamb
August 06, 2026                               https://wiki.debian.org/LTS
- -------------------------------------------------------------------------

Package        : async-http-client
Version        : 2.12.2-1+deb11u1
CVE ID         : CVE-2026-55688
Debian Bug     : 1141445

It was discovered that there was a potential cookie injection
vulnerability in async-http-client, Java library used to make
asynchronous HTTP requests.

CVE-2026-55688

    Prevent a potential cookie injection or cookie tossing
    vulnerability. ThreadSafeCookieStore stored a cookie under the
    value of its Domain attribute, without verifying that the
    responding host is allowed to set a cookie for that domain,
    therefore leading to cookie tossing/injection issues.

For Debian 11 bullseye, this problem has been fixed in version
2.12.2-1+deb11u1.

For Debian 12 bookworm, this problem has been fixed in version
2.12.3-1+deb12u1.

We recommend that you upgrade your async-http-client packages.

For the detailed security status of async-http-client please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/async-http-cl...

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEwv5L0nHBObhsUz5GHpU+J9QxHlgFAmp0rjAACgkQHpU+J9Qx
HlhXHw//d6Lo6FbY2cpDc6KNRX7LRcQMVr6jHxIYB3Rv9Z6nPImb+Ak/W9twUzkT
zNQmTWCnU59683Ufl8knhD0+cJhTo1jVjdp1npR89rJChrA3NxWS3/Uif8lXK5nz
ofuYyax66DNjNk/N3HRcSwgcphz3+MPYjuv44/Cb+S0DJ311mNAg1Jz5JAgVKvyt
j8x17h2y/9RgFyMExN9avIXFTr+2wIxqSAm3/kfPy8xWevENgxvwII7DNfOICADf
l1YNUQPVAdn7p0yvPcmizjltEm3ulJYtAYv8phH3kb6jOOcfqRgM9fbH2Nhe3aaW
YURGlHAPLxcA0AZsVBAn3Ff/bQCLO3JdDgD1p+YboBMxpkY/zBgdupMqXiTn9vH/
OHPqPCOrUq/pKZJ+oHQ/CRYZmnwcUB8yScdXI4Rv1uiXj41ewijoj9rrH3nrc0Dp
hjbDLg3/qYWWNTPSGXlIDvbhKoRq8xYyWgCFiKQCC672d86mZwYNUvqdQaixY2eH
Z4FvJg9tMWnJ5ieE1Yi6JclJ+Kv87v+JnjBn94P5GDrnj/s29QFahkfS/Agmj2f5
DcsFWUm6gneodl7UsoF4F9jZL6douzr6fnvBOFMumJPgF5BvkzbbzMcOyFnvgZlu
e8q8lH9mKFdNOdY3K+crzJnvjme9/3ZDCXids1GfQOSDP4UgzF8=
=RTZe
-----END PGP SIGNATURE-----