Hyperxpro

**Name of the Vulnerable Software and Affected Versions** AsyncHttpClient versions 2.0.0 through 2.15.9 AsyncHttpClient versions 3.0.0.Beta1 through 3.0.10 **Description** The `ThreadSafeCookieStore` component fails to verify if a responding host is authorized to set a cookie for a specific domain before storing it under that domain's attribute. This leads to cookie tossing or cookie injection, where a host connected to by the client can plant a cookie scoped to an unrelated domain. Consequently, the client will send this injected cookie in subsequent requests to that unrelated domain. This affects applications using a single, shared `CookieStore` instance to communicate with both a trusted host and a host influenced by an attacker. **Recommendations** Update AsyncHttpClient to version 2.16.0. Update AsyncHttpClient to version 3.0.11.