278 matches found
GHSA-F8M2-889X-VW4X AsyncHttpClient re-sends client-wide realm credentials to a cross-origin redirect target
Impact A client configured with a client-wide realm a Realm set on the config builder rather than on an individual request and following redirects could re-send those credentials to a redirect target on a different origin. The redirect code strips the per-exchange realm, but when the target...
AsyncHttpClient re-sends client-wide realm credentials to a cross-origin redirect target
Impact A client configured with a client-wide realm a Realm set on the config builder rather than on an individual request and following redirects could re-send those credentials to a redirect target on a different origin. The redirect code strips the per-exchange realm, but when the target...
AsyncHttpClient sends origin credentials to the proxy on the plaintext CONNECT request
Impact When a request uses an HTTP proxy to reach an HTTPS origin, the client opens the tunnel with a plaintext CONNECT sent to the proxy before any TLS exists. On affected versions the origin's preemptive credentials were added to that CONNECT. A Basic realm sent Authorization: Basic...
GHSA-XR57-GCX8-52HF AsyncHttpClient sends origin credentials to the proxy on the plaintext CONNECT request
Impact When a request uses an HTTP proxy to reach an HTTPS origin, the client opens the tunnel with a plaintext CONNECT sent to the proxy before any TLS exists. On affected versions the origin's preemptive credentials were added to that CONNECT. A Basic realm sent Authorization: Basic...
GHSA-7GRG-JCF7-RPMX AsyncHttpClient's unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of service
Impact With automatic response decompression enabled the default, the HTTP/1.1 path decompresses response bodies with no limit on the total output size. A hostile or compromised server, or an attacker who can change a response in transit, can send a small compressed body that inflates without bou...
AsyncHttpClient's unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of service
Impact With automatic response decompression enabled the default, the HTTP/1.1 path decompresses response bodies with no limit on the total output size. A hostile or compromised server, or an attacker who can change a response in transit, can send a small compressed body that inflates without bou...
GHSA-FJ9W-C36G-H5X8 AsyncHttpClient doesn't verify SCRAM and Digest mutual-authentication responses
Impact For SCRAM, and for Digest with mutual authentication, the client computes the server's verification value the SCRAM ServerSignature, or the Digest rspauth but does not act on the result. If the value is present and does not verify, the client only logs it and still delivers the response to...
AsyncHttpClient doesn't verify SCRAM and Digest mutual-authentication responses
Impact For SCRAM, and for Digest with mutual authentication, the client computes the server's verification value the SCRAM ServerSignature, or the Digest rspauth but does not act on the result. If the value is present and does not verify, the client only logs it and still delivers the response to...
DEBIAN-CVE-2026-85720
The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 and 3.0.12, a request using an HTTP proxy to reach an HTTPS origin can expose preemptive origin credentials because NettyRequestFactory and...
CVE-2026-85720
The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 and 3.0.12, a request using an HTTP proxy to reach an HTTPS origin can expose preemptive origin credentials because NettyRequestFactory and...
CVE-2026-85716
The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 3.0.8 until 3.0.12, processScramAuthenticationInfo and processAuthenticationInfo compute the SCRAM ServerSignature or Digest rspauth verification result but log...
UBUNTU-CVE-2026-85720
The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 and 3.0.12, a request using an HTTP proxy to reach an HTTPS origin can expose preemptive origin credentials because NettyRequestFactory and...
UBUNTU-CVE-2026-85716
The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 3.0.8 until 3.0.12, processScramAuthenticationInfo and processAuthenticationInfo compute the SCRAM ServerSignature or Digest rspauth verification result but log...
CVE-2026-85716
The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 3.0.8 until 3.0.12, processScramAuthenticationInfo and processAuthenticationInfo compute the SCRAM ServerSignature or Digest rspauth verification result but log...
CVE-2026-85720
The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 and 3.0.12, a request using an HTTP proxy to reach an HTTPS origin can expose preemptive origin credentials because NettyRequestFactory and...
CVE-2026-85716 AsyncHttpClient: SCRAM and Digest mutual-authentication responses are not verified
The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 3.0.8 until 3.0.12, processScramAuthenticationInfo and processAuthenticationInfo compute the SCRAM ServerSignature or Digest rspauth verification result but log...
CVE-2026-85716 AsyncHttpClient: SCRAM and Digest mutual-authentication responses are not verified
The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 3.0.8 until 3.0.12, processScramAuthenticationInfo and processAuthenticationInfo compute the SCRAM ServerSignature or Digest rspauth verification result but log...
EUVD-2026-82313
The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 3.0.8 until 3.0.12, processScramAuthenticationInfo and processAuthenticationInfo compute the SCRAM ServerSignature or Digest rspauth verification result but log...
CVE-2026-85716
The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 3.0.8 until 3.0.12, processScramAuthenticationInfo and processAuthenticationInfo compute the SCRAM ServerSignature or Digest rspauth verification result but log...
CVE-2026-85716
CVE-2026-85716 affects the AsyncHttpClient (AHC) Java library in versions 3.0.8 through 3.0.12 . The functions processScramAuthenticationInfo and processAuthenticationInfo compute the SCRAM ServerSignature or Digest rspauth verification result but, upon a mismatch, only log the discrepancy and st...