org.asynchttpclient:async-http-client
Built from the advisories that name this package: its registry metadata (versions, licence, dependencies) has not been fetched by this service yet.
At a glance
- Ecosystem
- Maven
- Vulnerability status
- affected by 1 advisory(ies)
Advisories (18)
| Advisory | Affected versions | Latest version |
|---|---|---|
| GHSA-2jwh-9rmr-j4xf AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader (Bypass of CVE-2024-53990 Fix) | 3.0.0 – < 3.0.14 ; 2.1.0 – 2.16.1 | Not affected |
| GHSA-3wp9-xfwm-rjjf AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel | 3.0.0 – < 3.0.12 ; 2.0.0 – < 2.16.1 | Not affected |
| GHSA-7grg-jcf7-rpmx AsyncHttpClient's unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of service | 3.0.0 – < 3.0.12 ; 2.0.0 – < 2.16.1 | Not affected |
| GHSA-93jq-624g-4p9p Improper Input Validation in async-http-client | < 2.0.35 | Affected |
| GHSA-cmxv-58fp-fm3g AsyncHttpClient leaks authorization credentials to untrusted domains on cross-origin redirects | 3.0.0.Beta1 – < 3.0.9 ; 2.0.0 – < 2.14.5 | Not affected |
| GHSA-f8m2-889x-vw4x AsyncHttpClient re-sends client-wide realm credentials to a cross-origin redirect target | 3.0.9 – < 3.0.12 ; 2.14.5 – < 2.16.1 | Not affected |
| GHSA-f9m8-cv68-674w AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.uk | 3.0.0 – < 3.0.13 ; 2.0.0 – < 2.16.1 | Not affected |
| GHSA-fj9w-c36g-h5x8 AsyncHttpClient doesn't verify SCRAM and Digest mutual-authentication responses | 3.0.8 – < 3.0.12 | Not affected |
| GHSA-fmxf-pm6p-7xgm async-http-client: Cookie header not stripped on cross-origin redirect | 3.0.0.Beta1 – < 3.0.10 ; 2.0.0 – < 2.15.0 | Not affected |
| GHSA-jmqq-x5g9-9p2w AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host | 3.0.0 – < 3.0.13 ; 2.0.0 – < 2.16.1 | Not affected |
| GHSA-m452-q8c9-rg2f AsyncHttpClient stores cookie for an unrelated domain (cookie tossing) via ThreadSafeCookieStore | 3.0.0.Beta1 – < 3.0.11 ; 2.0.0 – < 2.16.0 | Not affected |
| GHSA-mfj3-87qq-382v AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random source | 3.0.0 – < 3.0.12 ; 2.0.0 – < 2.16.1 | Not affected |
| GHSA-mfj5-cf8g-g2fv AsyncHttpClient (AHC) library's `CookieStore` replaces explicitly defined `Cookie`s | 2.1.0 – < 2.12.4 ; 3.0.0.Beta1 – < 3.0.1 | Not affected |
| GHSA-p2jm-6hj6-9rjg AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPS | 3.0.0 – < 3.0.14 ; 2.1.0 – 2.16.1 | Not affected |
| GHSA-rqf5-2wxv-rjf4 AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext | 3.0.0.Beta1 – < 3.0.13 ; 2.0.0 – < 2.16.1 | Not affected |
| GHSA-v2j5-22fr-j62r AsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy logins | 3.0.0 – < 3.0.14 ; 2.0.0 – 2.16.1 | Not affected |
| GHSA-x8v2-478q-2hvg AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabled | 3.0.0 – < 3.0.14 ; 2.2.0 – 2.16.1 | Not affected |
| GHSA-xr57-gcx8-52hf AsyncHttpClient sends origin credentials to the proxy on the plaintext CONNECT request | 3.0.0 – < 3.0.12 ; 2.0.0 – < 2.16.1 | Not affected |
Sources
| Source | Licence |
|---|