-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Wed, 05 Aug 2026 17:35:03 -0700 Source: async-http-client Built-For-Profiles: nocheck Architecture: source Version: 2.12.3-1+deb12u1 Distribution: bookworm-security Urgency: high Maintainer: Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian.org> Changed-By: Chris Lamb <lamby@debian.org> Closes: 1141445 Changes: async-http-client (2.12.3-1+deb12u1) bookworm-security; urgency=high . * Non-maintainer upload by the Debian LTS team. * CVE-2026-55688: Prevent a potential cookie injection or cookie tossing vulnerability. ThreadSafeCookieStore stored a cookie under the value of its Domain attribute, without verifying that the responding host is allowed to set a cookie for that domain, therefore leading to cookie tossing/injection issues. (Closes: #1141445) Checksums-Sha1: b9904d163d5252a8841375fee0d1ccdcca31628a 2296 async-http-client_2.12.3-1+deb12u1.dsc 8f50e17e1467bf8d08569f1ede0fd4acfdabcb44 512724 async-http-client_2.12.3.orig.tar.xz 59e48544e1eff4214c18b9099f8cbd641914a825 5852 async-http-client_2.12.3-1+deb12u1.debian.tar.xz 329b454c3f86df10cb6a6bc6d6ac4f8f93b10cf0 15167 async-http-client_2.12.3-1+deb12u1_amd64.buildinfo Checksums-Sha256: daee4fba95ea0be5ee4c52dd6674b19362505806935e4b5d09abdad9c1d156ea 2296 async-http-client_2.12.3-1+deb12u1.dsc 2b9f975c675a955595dfa3b21d635c5af3d0e92a3e6f7e6c9c0451227c83d044 512724 async-http-client_2.12.3.orig.tar.xz 7f3c0847422829e02abd9194c74670ebffc8dad670d7d99d5f74688d57d40394 5852 async-http-client_2.12.3-1+deb12u1.debian.tar.xz 9a6c3a3fb5cd145c0ef204be8b17f5e9a40da44eda832157e661b83551108068 15167 async-http-client_2.12.3-1+deb12u1_amd64.buildinfo Files: c0b54bbe05133b9008cab4be5f474756 2296 java optional async-http-client_2.12.3-1+deb12u1.dsc db2c18c5f649519a82bb6d0803e8f046 512724 java optional async-http-client_2.12.3.orig.tar.xz 5068df315383e2fff7b3c24efc3f513b 5852 java optional async-http-client_2.12.3-1+deb12u1.debian.tar.xz ebe28a97665c4bca22bf55e85b5df275 15167 java optional async-http-client_2.12.3-1+deb12u1_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEwv5L0nHBObhsUz5GHpU+J9QxHlgFAmp40ZAACgkQHpU+J9Qx HliEAhAAoHtchC5HJiAeQQ00KFEXr8S21EyxJDLiCEe57lLp2Q/3J/ZJvpuWFtCe AO31nlCrDy/hnlGS7WR1io+o4IvawDrqQI86XTvcJ9BFHVfN9ON8CeE9xD3nNDBQ 05hrhCxCXWhxbYnh/u4/d8GavUYJ/QeHTe1Gubfmtky6eTCxn8OHBQlA5hypmCwH mqfP+gleH/Y1+np3jgCpgYIy2+vE3SKCd+ggDs0FyyCg0e4hWt9f8fQI+Y0nuZJU wi2LcBwS0vWg5lz2ureE38+PgRNr6Zq8MDBAF8c6sbTOUroSjkP7PMYVSZIp/Ofu Z86H0r9Z3w0dMjnoHz3qA3pMu/zON7NqD5ChWIkfBOR5I1tY6hQAI6+GLrWmwSNp soltIHVvZBvbS/oRBT2VPMn47jaIE364Ps2tfoZl2I7DPKde4784ceyW215Fb1jd /FQva0kFVaogRVMSh24xPnzGjfqFeo/7LnPHtJAa+bW/RIdvh0szyantmBrGtZXZ Xl7bFqyWQGh+z9oGLrZN0bgMkoXvMMGS4rYns15rc7ct5sTjkn8+btToeYMoZSOK YwRUWSMOiub2yN+WvpauXvzSJCflz0KOehxgH70VRxC8UFM+QL0uTj+FFev742+H vcJ/WI+RCEM7fPTuyPLOI6jsggSpzMAv9cmhZEpaOSAlMh+GWq8= =0rPT -----END PGP SIGNATURE-----
