AsyncHttpClient async-http-client
25 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-102740 | >= 2.0.0, < 2.16.1 ; >= 3.0.0, < 3.0.12 | AsyncHttpClient: Resumable download index store is created world-readable and follows a planted symlink | MEDIUM 5.8 | 0.1 % | ||
| CVE-2026-107226 | >= 2.1.0, <= 2.16.1 ; >= 3.0.0, < 3.0.14 | AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPS | MEDIUM 6.8 | 0.3 % | ||
| CVE-2026-107285 | >= 3.0.0, <3.0.12 ; >= 2.0.0, < 2.16.1 | AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel | MEDIUM 5.9 | 0.2 % | ||
| CVE-2026-107284 | >= 3.0.0, < 3.0.12 ; >= 2.0.0, < 2.16.1 | AsyncHttpClient: WebSocket handshake continues after a failed Sec-WebSocket-Accept check | LOW 3.7 | 0.1 % | ||
| CVE-2026-107283 | >= 3.0.0, < 3.0.12 ; >= 2.0.0, < 2.16.1 | AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random source | LOW 3.7 | 0.3 % | ||
| CVE-2026-107282 | >= 3.0.0, < 3.0.13 ; >= 2.0.0, < 2.16.1 | AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host | CRITICAL 9.4 | 0.2 % | ||
| CVE-2026-107281 | >= 3.0.0, < 3.0.13 ; >= 2.0.0, < 2.16.1 | AsyncHttpClient: Connection pool key omits the authenticated principal, so an NTLM or Negotiate connection is reused across identities | HIGH 7.6 | 0.2 % | ||
| CVE-2026-107280 | >= 3.0.0, < 3.0.13 ; >= 2.0.0, < 2.16.1 | AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.uk | MEDIUM 6.9 | 0.3 % | ||
| CVE-2026-107279 | = 3.0.12 | AsyncHttpClient: Digest mutual authentication is switched off by a peer offering qop=auth-int | HIGH 8.8 | 0.4 % | ||
| CVE-2026-107232 | >= 3.0.0, < 3.0.12 ; >= 2.0.0, < 2.16.1 | AsyncHttpClient: Origin credentials sent in cleartext to a proxy that rejects the CONNECT | HIGH 7.5 | 0.2 % | ||
| CVE-2026-107231 | >= 3.0.0.Beta1, < 3.0.13 ; >= 2.0.0, < 2.16.1 | AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext | HIGH 8.7 | 0.2 % | ||
| CVE-2026-107230 | >= 3.0.0, < 3.0.14 ; >= 2.0.0, <= 2.16.1 | AsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy logins | HIGH 7.4 | 0.2 % | ||
| CVE-2026-107229 | >= 3.0.11, < 3.0.14 ; >= 2.16.0, <= 2.16.1 | AsyncHttpClient: Incomplete origin checks in the default cookie store allow cookie tossing onto public-suffix and IP-address hosts | MEDIUM 4.0 | 0.3 % | ||
| CVE-2026-107228 | >= 3.0.0, < 3.0.14 ; >= 2.1.0, <= 2.16.1 | AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader (Bypass of CVE-2024-53990 Fix) | MEDIUM 6.8 | 0.3 % | ||
| CVE-2026-107227 | >= 3.0.0, < 3.0.14 ; >= 2.2.0, <= 2.16.1 | AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is … | HIGH 7.5 | 0.4 % | ||
| CVE-2026-85716 | >= 3.0.8, < 3.0.12 | AsyncHttpClient: SCRAM and Digest mutual-authentication responses are not verified | LOW 3.7 | 0.4 % | ||
| CVE-2026-85720 | >= 2.0.0, < 2.16.1 ; >= 3.0.0, < 3.0.12 | AsyncHttpClient: Origin credentials sent to the proxy on the plaintext CONNECT request | MEDIUM 5.9 | 0.3 % | ||
| CVE-2026-85718 | >= 3.0.8, < 3.0.12 | AsyncHttpClient: Connection permit leak on TLS handshake failure causes per-host denial of service | MEDIUM 5.9 | 0.5 % | ||
| CVE-2026-85721 | >= 2.0.0, < 2.16.1 ; >= 3.0.0, < 3.0.12 | AsyncHttpClient: Unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of service | HIGH 7.5 | 0.6 % | ||
| CVE-2026-85717 | >= 2.14.5, < 2.16.1 ; >= 3.0.9, < 3.0.12 | AsyncHttpClient: Client-wide realm credentials re-sent to a cross-origin redirect target | MEDIUM 6.8 | 0.5 % | ||
| CVE-2026-85719 | >= 2.1.0, < 2.16.1 ; >= 3.0.0, < 3.0.12 | AsyncHttpClient: SOCKS proxy credentials sent to the origin server over plaintext HTTP | HIGH 7.5 | 0.4 % | ||
| CVE-2026-55688 | >= 2.0.0, < 2.16.0 ; >= 3.0.0.Beta1, < 3.0.11 | AsyncHttpClient: Cookie stored for an unrelated domain (cookie tossing) via ThreadSafeCookieStore | MEDIUM 4.0 | 0.3 % | ||
| CVE-2026-45300 | >= 3.0.0.Beta1, < 3.0.10 ; >= 2.0.0, < 2.15.0 | async-http-client: Cookie header not stripped on cross-origin redirect | HIGH 7.4 | 0.4 % | ||
| CVE-2026-40490 | >= 3.0.0.Beta1, < 3.0.9 ; < 2.14.5 | AsyncHttpClient leaks authorization credentials to untrusted domains on cross-origin redirects | MEDIUM 6.8 | 0.4 % | ||
| CVE-2024-53990 | < 3.0.1 | AsyncHttpClient (AHC) library's `CookieStore` replaces explicitly defined `Cookie`s | CRITICAL 9.2 | 0.7 % |