CVE-2026-107230

The AsyncHttpClient (AHC) Java library, from version 2.0.0 until 3.0.14 , contains a vulnerability where connection-pool partitioning fails to omit identity-defining fields for Kerberos, SPNEGO, NTLM , and authenticated proxy connections. This flaw allows logins lacking configured principals, pro...

CVE-2026-107230 AsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy logins

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 3.0.14, connection-pool partitioning still omits identity-defining fields for Kerberos, SPNEGO, NTLM, and authenticated proxy connections. Logins...

CVE-2026-107230

Removed by vendor...

EUVD-2026-94590

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.16.0 until 3.0.14, ThreadSafeCookieStore incompletely validates cookie Domain attributes. Missing private-section and default public-suffix rules, absent...

CVE-2026-107229

The AsyncHttpClient (AHC) library for Java applications contains a vulnerability in the ThreadSafeCookieStore component. From version 2.16.0 until 3.0.14 , the library incompletely validates cookie Domain attributes due to missing private-section and public-suffix rules, lack of A-label normaliza...

CVE-2026-107229 AsyncHttpClient: Incomplete origin checks in the default cookie store allow cookie tossing onto public-suffix and IP-address hosts

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.16.0 until 3.0.14, ThreadSafeCookieStore incompletely validates cookie Domain attributes. Missing private-section and default public-suffix rules, absent...

CVE-2026-107229 AsyncHttpClient: Incomplete origin checks in the default cookie store allow cookie tossing onto public-suffix and IP-address hosts

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.16.0 until 3.0.14, ThreadSafeCookieStore incompletely validates cookie Domain attributes. Missing private-section and default public-suffix rules, absent...

CVE-2026-107229

Removed by vendor...

CVE-2026-107228 AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader (Bypass of CVE-2024-53990 Fix)

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 3.0.14, the enabled-by-default cookie store replaces a Cookie header explicitly supplied through setHeader or addHeader whenever the store contribut...

CVE-2026-107228

The AsyncHttpClient (AHC) library versions 2.1.0 through 3.0.14 contains a vulnerability where the default cookie store silently overrides explicit Cookie headers provided via setHeader or addHeader. In shared client environments, this allows cookies from one user's session to replace another use...

CVE-2026-107228 AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader (Bypass of CVE-2024-53990 Fix)

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 3.0.14, the enabled-by-default cookie store replaces a Cookie header explicitly supplied through setHeader or addHeader whenever the store contribut...

CVE-2026-107228

Removed by vendor...

CVE-2026-107227

Removed by vendor...

CVE-2026-107227 AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabled

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.2.0 until 3.0.14, WebSocket permessage-deflate decompression is unbounded when compression is enabled. The inbound pipeline aggregates compressed frames befor...

CVE-2026-107227

The AsyncHttpClient (AHC) library is vulnerable to a denial of service (DoS) attack via a decompression bomb when WebSocket permessage-deflate decompression is enabled. In versions 2.2.0 until 3.0.14 , the inbound pipeline aggregates compressed frames before inflation, meaning webSocketMaxFrameSi...

CVE-2026-107227 AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabled

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.2.0 until 3.0.14, WebSocket permessage-deflate decompression is unbounded when compression is enabled. The inbound pipeline aggregates compressed frames befor...

CVE-2026-107227

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.2.0 until 3.0.14, WebSocket permessage-deflate decompression is unbounded when compression is enabled. The inbound pipeline aggregates compressed frames befor...

CVE-2026-107227 AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabled

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.2.0 until 3.0.14, WebSocket permessage-deflate decompression is unbounded when compression is enabled. The inbound pipeline aggregates compressed frames befor...

PT-2026-107680

Name of the Vulnerable Software and Affected Versions AsyncHttpClient versions 2.0.0 through 3.0.13 Description Connection-pool partitioning omits identity-defining fields for Kerberos, SPNEGO, NTLM, and authenticated proxy connections. This allows logins without a configured principal, proxy...

PT-2026-107679

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.16.0 until 3.0.14, ThreadSafeCookieStore incompletely validates cookie Domain attributes. Missing private-section and default public-suffix rules, absent...