CVE-2024-53990: Cookie Hijacking in Async HTTP Client

The core of this vulnerability lies in the asynchronous nature of Async HTTP Client and its automatic CookieStore management. When making HTTP requests, the CookieStore silently overwrites explicitly provided cookies with any cookies sharing the same name that are already stored within the jar. In multi-user environments, this means a malicious actor could potentially craft a request that replaces one user's session cookie with another's, effectively impersonating that user. This could lead to unauthorized access to sensitive data, modification of user accounts, or even complete control over the application. The impact is particularly severe for applications handling sensitive information like financial transactions or personal data, as session hijacking can grant attackers full access to user accounts and associated resources.

1. Reserved2024-11-25
2. Published2024-12-02
3. Modified2026-02-04
4. EPSS updated2026-04-02

The primary mitigation for CVE-2024-53990 is to upgrade to version 2.12.4 or later of Async HTTP Client. If an immediate upgrade is not feasible due to compatibility issues or breaking changes, consider disabling the automatic CookieStore and managing cookies explicitly in your application code. This provides greater control over cookie handling and prevents the silent replacement behavior. As a temporary workaround, you could implement stricter cookie validation logic within your application to detect and reject unexpected cookie values. Monitor application logs for unusual cookie activity, which could indicate an attempted exploitation. After upgrading, confirm the fix by sending requests with explicit cookies and verifying that they are not being overwritten by the CookieStore.