164 matches found
CVE-2026-45300
creationtimestamp| type| source ---|---|--- 2026-05-12 21:02:02+00:00| published-proof-of-concept| https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-fmxf-pm6p-7xgm 2026-06-05 21:15:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnl2nqfonh2z...
Security Bulletin: DevOps Test Performance contains a vulnerability related to use of AsyncHttpClient
Summary Due to use of AsyncHttpClient, DevOps Test Performance and Rational Performance Tester contain a potential vulnerability where Authorization/Proxy-Authorization headers are improperly leaked. Vulnerability Details CVEID:CVE-2026-40490 DESCRIPTION: The AsyncHttpClient AHC library allows Ja...
UBUNTU-CVE-2026-40490
The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. When redirect following is enabled followRedirecttrue, versions of AsyncHttpClient prior to 3.0.9 and 2.14.5 forward Authorization and Proxy-Authorization headers...
ai.evolv:ascend-sdk (0.5.0), ai.taskmonk:taskmonk-sdk (>=1.7, <=1.16.6) +2850 more potentially affected by CVE-2026-40490 via org.asynchttpclient:async-http-client (>=2.0.0, <=2.12.4)
org.asynchttpclient:async-http-client MAVEN version =2.0.0, =1.7, =4.1.0, =4.2.14, =4.1.0, =4.1.0, =4.1.0, =4.2.14, =3.5.5, =3.5.5, =3.5.5, =3.5.7-jre7.0 and more Source cves: CVE-2026-40490 Source advisory: MEND:CVE-2026-40490...
Async HTTP Client security vulnerabilities
Async Http Client is an open-source Java-based asynchronous HTTP and WebSocket client library developed by AsyncHttpClient. Versions prior to 3.0.9 and 2.14.5 of Async Http Client had security vulnerabilities. These vulnerabilities stemmed from the redirection process, where authorization headers...
EUVD-2018-0557
Malware in sbrugna...
EUVD-2022-3182
Malicious code in bioql PyPI...
EUVD-2023-1887
Malicious code in bioql PyPI...
CVE-2023-0040
Versions of Async HTTP Client prior to 1.13.2 are vulnerable to a form of targeted request manipulation called CRLF injection. This vulnerability was the result of insufficient validation of HTTP header field values before sending them to the network. Users are vulnerable if they pass untrusted...
Security Bulletin: Vulnerabiity in Async Http Client affects watsonx.data
Summary Async Http Client aka async-http-client could allow a remote attacker to bypass security restrictions. This could affect watsonx.data. Vulnerability Details CVEID:CVE-2017-14063 DESCRIPTION: Async Http Client aka async-http-client could allow a remote attacker to bypass security...
Async Http Client RequestBuilder CookieStore Unauthorized Access
The vulnerability of the RequestBuilder class in the CookieStore interface of the asynchronous HTTP request processing library Async Http Client is related to the replacement of cookie files due to incorrect authentication procedures. Exploiting this vulnerability can allow an attacker operating...
com.arpnetworking.metrics:mad-experimental (1.2.3), com.arpnetworking.metrics:metrics-aggregator-daemon (>=1.22.2, <=1.22.4) +30 more potentially affected by CVE-2024-53990 via org.asynchttpclient:async-http-client (>=3.0.0.beta1, <=3.0.0)
org.asynchttpclient:async-http-client MAVEN version =3.0.0.beta1, =1.22.2, =1.13.6, =0.0.9, =1.3.13, =1.3.13, =1.3.13, =0.1.0, =0.0.2, =0.0.1-alpha, =0.3.1, =0.3.4 and more Source cves: CVE-2024-53990 Source advisory: OSV:GHSA-MFJ5-CF8G-G2FV...
ai.taskmonk:taskmonk-sdk (>=1.7, <=1.16.6), app.peac:core (0.0.1) +2363 more potentially affected by CVE-2024-53990 via org.asynchttpclient:async-http-client (>=2.1.0, <=2.12.3)
org.asynchttpclient:async-http-client MAVEN version =2.1.0, =1.7, =4.1.0, =4.0.0-beta.2, =0.7.0, =0.7.0, =0.1.0, =0.2.0, =0.7.0, =0.7.0, =0.1.0, =0.2.0, =0.9.2 and more Source cves: CVE-2024-53990 Source advisory: OSV:GHSA-MFJ5-CF8G-G2FV...
UBUNTU-CVE-2024-53990
The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. When making any HTTP request, the automatically enabled and self-managed CookieStore aka cookie jar will silently replace explicitly defined Cookies with any that ha...
ai.taskmonk:taskmonk-sdk (>=1.7, <=1.16.6), app.peac:core (0.0.1) +2363 more potentially affected by CVE-2024-53990 via org.asynchttpclient:async-http-client (>=2.1.0, <=2.12.3)
org.asynchttpclient:async-http-client MAVEN version =2.1.0, =1.7, =4.1.0, =4.0.0-beta.2, =0.7.0, =0.7.0, =0.1.0, =0.2.0, =0.7.0, =0.7.0, =0.1.0, =0.2.0, =0.9.2 and more Source cves: CVE-2024-53990 Source advisory: MEND:CVE-2024-53990...
Async Http Client Authorization Vulnerability
Async Http Client is AsyncHttpClient open source asynchronous Http and WebSocket client library for Java. An authorization issue vulnerability exists in Async Http Client version 3.0.0, which stems from an automatically enabled and self-managed CookieStore handling mechanism that can lead to...
Security Bulletin: Vulnerability in Async Http Client affects IBM watsonx.data
Summary Async Http Client aka async-http-client could allow a remote attacker to bypass security restrictions, caused by the failure to parse the fragment identifier of the URL when handling '?' character. By using a specially-crafted URL with '?' character, an attacker could exploit this...
Security Bulletin: Vulnerability in Async Http Client affects IBM watsonx.data
Summary Async Http Client aka async-http-client could allow a remote attacker to bypass security restrictions, caused by the failure to parse the fragment identifier of the URL when handling '?' character. By using a specially-crafted URL with '?' character, an attacker could exploit this...
CVE-2024-34364
Envoy is a cloud-native, open source edge and service proxy. Envoy exposed an out-of-memory OOM vector from the mirror response, since async HTTP client will buffer the response with an unbounded buffer...
CVE-2024-34364: Uncontrolled Resource Consumption
Envoy is a cloud-native, open source edge and service proxy. Envoy exposed an out-of-memory OOM vector from the mirror response, since async HTTP client will buffer the response with an unbounded buffer...