-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Wed, 05 Aug 2026 17:26:41 -0700 Source: async-http-client Architecture: source Version: 2.12.2-1+deb11u1 Distribution: bullseye-security Urgency: high Maintainer: Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian.org> Changed-By: Chris Lamb <lamby@debian.org> Closes: 1141445 Changes: async-http-client (2.12.2-1+deb11u1) bullseye-security; urgency=high . * Non-maintainer upload by the Debian LTS team. * CVE-2026-55688: Prevent a potential cookie injection or cookie tossing vulnerability. ThreadSafeCookieStore stored a cookie under the value of its Domain attribute, without verifying that the responding host is allowed to set a cookie for that domain, therefore leading to cookie tossing/injection issues. (Closes: #1141445) Checksums-Sha1: f843e68fac8c8aacc327f546573b95b16180ed4a 2294 async-http-client_2.12.2-1+deb11u1.dsc 3894f1ebdc48b543f251a4acb7a3489c6661778d 511172 async-http-client_2.12.2.orig.tar.xz 22a0ec89e1ccd59c7d14ce9f9e565281cf1a4e81 5832 async-http-client_2.12.2-1+deb11u1.debian.tar.xz 4e3587bbd80f3cddd005d8fbd9985c1cdec5de4a 5359 async-http-client_2.12.2-1+deb11u1_source.buildinfo Checksums-Sha256: c1697ea10e5511c145fc059cd004781dcb2d94fc6e56509f9c6657bbde0512a9 2294 async-http-client_2.12.2-1+deb11u1.dsc 79ec04ef2020a5a38427a86a3b3b7fdaa78665e1b6e9e5b3a34d19a685c346e6 511172 async-http-client_2.12.2.orig.tar.xz 1028936832f82441a6b13ba2cee15602332b51745beaed0b71b1ef9080714159 5832 async-http-client_2.12.2-1+deb11u1.debian.tar.xz 34d9b3398ee4071e61fa473d6abec0ed69e225bd7350359e431307f0cca3ab2d 5359 async-http-client_2.12.2-1+deb11u1_source.buildinfo Files: 9f6bb3f189cf0606efd74595683a37ba 2294 java optional async-http-client_2.12.2-1+deb11u1.dsc b904025c9effaa35653d3d39060c15b9 511172 java optional async-http-client_2.12.2.orig.tar.xz e671a7edecc4de26d9aac4e93bd06f98 5832 java optional async-http-client_2.12.2-1+deb11u1.debian.tar.xz b585252d2960d73bba0bbcd232d06213 5359 java optional async-http-client_2.12.2-1+deb11u1_source.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEwv5L0nHBObhsUz5GHpU+J9QxHlgFAmp0rn4ACgkQHpU+J9Qx HlhP8Q//QXWrmJFg0cjSp7mc+CxAUQTr7vt4PY9fUeLVu6hJFejFOWf70SzgLdCY VtdC7CXM9wpvEmncmq7r1Goi/y98tiWLnKzSd8EMbIXkNCJovBgzVoshxXe47HVO MGPdAW3ciQVYAK8Gv5rq3KzoFQ+QnCT0brmzF8QwwjSIjQMDTRkeCFYQaMMXeavs HdfJYYQl/ojJzYGWokVlISQT9v6EulgoW//+ZeazII9U9/0x9YjvoYVego+7ZEp/ jsowtUw/q8iv8wStOvTrzu0TDDEzaoLf3YwiCsA1UZ3z1LpvUbn95jmG+msy70Ad gdOFPKH50rBnpQa7ZlXQwt0X4wsq2DJUdwNokHa4FcwLujMWEIZ3QPRLqtL2+QWF 6kLGb4aAZNSX78RvZHD6gdNHHugtHBU13QQk1b3OiAFA01t6oZSvOP0lScuQl1K9 yIqvjcJuyNZctflUzunaoyFDJaD7w7yRZGHic35rGs4NNezw3nHuo95YzvrxrQ+8 4oiv+yH1bBeuMqxu0gDVrDUqZPlvUpg59kqQt1l/54ux078C8Ag8aWpcDFrMYWBW CYGHpyDqP0Ht+pbbvXZxYJ+X9dE8g7PfQwoCb8/zgeQ0F1/tKedJar79lHCA8vUm rMVS9gIYm1Cozrhf8vE/mFXGkcwjNK2T6wNSFscLOkdWijtfQFE= =x6aJ -----END PGP SIGNATURE-----
