CVE-2024-53990

What it actually does

The AsyncHttpClient library's self-managed CookieStore silently overwrites explicitly supplied cookies that share the same name with entries already present in the jar, causing HTTP requests to carry cookies belonging to other users in multi-user Java applications.

Why it matters to the business

Multi-tenant services built on this library risk cross-user data exposure or unauthorized actions, increasing privacy incidents and compliance exposure; prevalence across Java HTTP clients heightens the need for prompt upgrades.

How an attack unfolds

An attacker with the ability to influence cookie names or observe multi-user traffic supplies or triggers requests containing duplicate cookie names; the library replaces the intended cookie with one from the shared jar, resulting in the request executing under another user's session without authentication bypass detection.

How to fix it

Upgrade asynchttpclient/async-http-client to a build containing commit 6bd376ad336a237ef02a632df0042d4eb22e2d32 or later; disable the automatic CookieStore or implement explicit per-request cookie isolation until the update is applied.

How to confirm the fix worked

Confirm the library version or commit hash in dependency manifests and runtime classpaths; test cookie handling behavior with duplicate-named cookies under concurrent user sessions to verify isolation is restored.

Typical attack path

1. Identify a multi-user Java service using AsyncHttpClient with per-user cookie handling
2. Craft or replay HTTP requests that include cookies sharing names with entries already stored in the shared CookieStore
3. Trigger the request path so the library performs automatic cookie replacement
4. Observe or leverage the resulting request executing with the unintended user's cookies

How to detect it

Review application logs for HTTP requests where cookie values unexpectedly differ from those explicitly set in code; correlate request timestamps with user session boundaries to surface cross-user cookie usage patterns.

What your security team should do

• Immediately inventory all Java applications depending on async-http-client and schedule upgrades to the fixed commit
• Review code paths that pass explicit cookies to AsyncHttpClient and add per-user cookie isolation controls
• Monitor dependency update channels for the next official release containing the fix