CVE-2026-107284

🗓️ 07 Oct 2026 21:27:03Reported by GitHub_MType

AsyncHttpClient WebSocketHandler.upgrade continues after failed Sec-WebSocket-Accept check.

Reporter	Title	Published	Views	Family All 18
Circl	CVE-2026-107284	8 Oct 202600:09	–	circl
Cvelist	CVE-2026-107284 AsyncHttpClient: WebSocket handshake continues after a failed Sec-WebSocket-Accept check	7 Oct 202621:27	–	cvelist
Debian CVE	CVE-2026-107284	7 Oct 202621:27	–	debiancve
EUVD	EUVD-2026-94644	7 Oct 202621:27	–	euvd
Mend	CVE-2026-107284	7 Oct 202621:27	–	mend
NVD	CVE-2026-107284	7 Oct 202622:17	–	nvd
osv_debian	DEBIAN-CVE-2026-107284	7 Oct 202622:17	–	osv_debian
osv_ubuntu	UBUNTU-CVE-2026-107284	7 Oct 202622:17	–	osv_ubuntu
Positive Technologies	PT-2026-107713	7 Oct 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-107284: Insufficient Verification of Data Authenticity	7 Oct 202600:00	–	rapid7

Vulners

Node

asynchttpclient_project async-http-clientRange3.0.0–3.0.12

asynchttpclient_project async-http-clientRange2.0.0–2.16.1

[
  {
    "vendor": "AsyncHttpClient",
    "product": "async-http-client",
    "versions": [
      {
        "version": ">= 3.0.0, < 3.0.12",
        "status": "affected"
      },
      {
        "version": ">= 2.0.0, < 2.16.1",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-2.16.1
github	www.github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.12
github	www.github.com/AsyncHttpClient/async-http-client/commit/75a278550aa9a980009d022fb4e635f9c8738c03
github	www.github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-rwhr-j9rv-85f8
github	www.github.com/AsyncHttpClient/async-http-client/commit/ccdcaa627db6d96dcc42105212cb3ba5048bd7f9

08 Oct 2026 20:35Current

6Medium risk

Vulners AI Score6

CVSS 3.13.7

EPSS0.00138

SSVC