AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.uk
Maven org.asynchttpclient:async-http-client · Upgrade to 3.0.13 or 2.16.1 by release line · >= 3.0.0, <= 3.0.12; >= 2.0.0, <= 2.16.0 · CVE-2026-107280 · GHSA-f9m8-cv68-674w · amended