PT-2026-107680

Name of the Vulnerable Software and Affected Versions AsyncHttpClient versions 2.0.0 through 3.0.13 Description Connection-pool partitioning omits identity-defining fields for Kerberos, SPNEGO, NTLM, and authenticated proxy connections. This allows logins without a configured principal, proxy...

PT-2026-107679

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.16.0 until 3.0.14, ThreadSafeCookieStore incompletely validates cookie Domain attributes. Missing private-section and default public-suffix rules, absent...

PT-2026-107685

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, the HTTP/1.1 connection-pool key excludes the authenticated principal for connection-oriented NTLM and Negotiate authentication. A pooled...

PT-2026-107713

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, WebSocketHandler.upgrade aborts a handshake whose Sec-WebSocket-Accept value is missing or invalid but continues into pipeline installati...

PT-2026-107681

Name of the Vulnerable Software and Affected Versions AsyncHttpClient versions prior to 3.0.13 AsyncHttpClient versions prior to 2.16.1 Description The AsyncHttpClient library, used by Java applications for asynchronous HTTP requests and responses, contains an issue where Realm.Builder incorrectl...

PT-2026-107682

Name of the Vulnerable Software and Affected Versions AsyncHttpClient versions prior to 3.0.12 AsyncHttpClient versions prior to 2.16.1 Description The library incorrectly infers the existence of an HTTP proxy tunnel based on the last request method instead of the result of the CONNECT request. I...

PT-2026-107712

Name of the Vulnerable Software and Affected Versions AsyncHttpClient versions prior to 3.0.12 AsyncHttpClient versions prior to 2.16.1 Description The Realm.Builder generates the HTTP Digest client nonce using ThreadLocalRandom instead of a cryptographically secure random source. Because HTTP...

PT-2026-107714

Name of the Vulnerable Software and Affected Versions AsyncHttpClient versions prior to 3.0.12 AsyncHttpClient versions prior to 2.16.1 Description When executing a proxied WebSocket ws request via the CONNECT method, the NettyRequestFactory.newNettyRequest and requestUri functions determine...

MGASA-2026-0467 Updated python-tornado packages fix security vulnerabilities

Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient Tornado has out-of-bounds memory access via C extension tornado AsyncHTTPClient accumulates decompressed chunks without size limit gzip bomb...

Updated python-tornado packages fix security vulnerabilities

Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient Tornado has out-of-bounds memory access via C extension tornado AsyncHTTPClient accumulates decompressed chunks without size limit gzip bomb...

CVE-2026-85719

A flaw was found in AsyncHttpClient. This vulnerability allows an attacker to expose SOCKS proxy credentials to the origin server when using an authenticated SOCKS proxy. This occurs because the library attaches Proxy-Authorization headers without verifying if the request is being sent to an HTTP...

CVE-2026-85716

A flaw was found in the AsyncHttpClient AHC library. This vulnerability allows a remote attacker to impersonate the server on a non-TLS Transport Layer Security or compromised network. The library's authentication process for SCRAM and Digest mutual-authentication does not properly verify server...

CVE-2026-85718

A flaw was found in AsyncHttpClient. When configured with connection limits, the library can leak a connection permit if a Transport Layer Security TLS handshake fails before completion. This permit leak can lead to resource exhaustion, allowing a remote attacker to cause a denial of service by...

CVE-2026-85721

A flaw was found in the AsyncHttpClient AHC library. A remote attacker, by sending a specially crafted, small compressed HTTP response, could exploit a vulnerability in the automatic response decompression mechanism. This flaw, caused by the lack of a cumulative output-size limit, allows the...

Linux Distros Unpatched Vulnerability : CVE-2026-85716

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 3.0.8 until 3.0.12,...

Linux Distros Unpatched Vulnerability : CVE-2026-85717

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.14.5 to 2.16.0 and fr...

Linux Distros Unpatched Vulnerability : CVE-2026-85718

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 3.0.8 until 3.0.12, a...

Linux Distros Unpatched Vulnerability : CVE-2026-85719

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 2.16.1 and...

Linux Distros Unpatched Vulnerability : CVE-2026-85721

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 and...

Linux Distros Unpatched Vulnerability : CVE-2026-85720

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 and...