CVE-2026-102740

🗓️ 15 Oct 2026 17:25:30Reported by MendType

mend🔗 www.mend.io👁 2 Views

Local information disclosure and file overwrite in AsyncHttpClient via shared state files.

Reporter	Title	Published	Views	Family All 13
Circl	CVE-2026-102740	15 Oct 202617:31	–	circl
CVE	CVE-2026-102740	15 Oct 202617:25	–	cve
Cvelist	CVE-2026-102740 AsyncHttpClient: Resumable download index store is created world-readable and follows a planted symlink	15 Oct 202617:25	–	cvelist
Debian CVE	CVE-2026-102740	15 Oct 202617:25	–	debiancve
EUVD	EUVD-2026-102223	15 Oct 202617:25	–	euvd
NVD	CVE-2026-102740	15 Oct 202618:17	–	nvd
osv_debian	DEBIAN-CVE-2026-102740	15 Oct 202618:17	–	osv_debian
osv_ubuntu	UBUNTU-CVE-2026-102740	16 Oct 202600:00	–	osv_ubuntu
Positive Technologies	PT-2026-115074	15 Oct 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-102740: UNIX Symbolic Link (Symlink) Following	15 Oct 202600:00	–	rapid7

Vulners

Node

OR

asynchttpclient_project async-http-clientRange2.0.0–2.16.1

asynchttpclient_project async-http-clientRange3.0.0–3.0.12

Source	Link
github	www.github.com/AsyncHttpClient/async-http-client/commit/d945ce3357b093e74526871cd309832a717ecfda
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102740.json
github	www.github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-2.16.1
github	www.github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.12
github	www.github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-cf59-3jcr-vfhw
github	www.github.com/AsyncHttpClient/async-http-client/commit/0422e11c954c4b026e986d1458f7a7a2eab7e591
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-102740
github	www.github.com/AsyncHttpClient/async-http-client/pull/2281

18 Oct 2026 08:34Current

6Medium risk

Vulners AI Score6

CVSS 45.8

CVSS 3.15.8

EPSS0.001

SSVC

CWE-379 CWE-732 CWE-61

AsyncHttpClient PropertiesBasedResumableProcessor information disclosure file overwrite symbolic link local attack