PT-2026-107714

Name of the Vulnerable Software and Affected Versions AsyncHttpClient versions prior to 3.0.12 AsyncHttpClient versions prior to 2.16.1 Description When executing a proxied WebSocket ws request via the CONNECT method, the NettyRequestFactory.newNettyRequest and requestUri functions determine...

CVE-2026-107284: Insufficient Verification of Data Authenticity

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, WebSocketHandler.upgrade aborts a handshake whose Sec-WebSocket-Accept value is missing or invalid but continues into pipeline installati...

CVE-2026-107285: Cleartext Transmission of Sensitive Information

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, a proxied ws request is carried through CONNECT, but NettyRequestFactory.newNettyRequest and requestUri decide whether to attach proxy...

PT-2026-107713

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, WebSocketHandler.upgrade aborts a handshake whose Sec-WebSocket-Accept value is missing or invalid but continues into pipeline installati...

PT-2026-107679

Name of the Vulnerable Software and Affected Versions AsyncHttpClient versions 2.16.0 through 3.0.13 Description The ThreadSafeCookieStore component incompletely validates cookie Domain attributes. This occurs due to missing private-section and default public-suffix rules, absent A-label...

CVE-2026-107283: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, Realm.Builder generates the HTTP Digest client nonce with ThreadLocalRandom rather than a cryptographically secure random source. Digest...

PT-2026-107683

Name of the Vulnerable Software and Affected Versions AsyncHttpClient versions prior to 3.0.13 Description In the AsyncHttpClient library, a peer offering only Digest qop=auth-int causes mutual-authentication verification to be skipped. This occurs because the computeExpectedRspAuth function in...

PT-2026-107685

Name of the Vulnerable Software and Affected Versions AsyncHttpClient versions prior to 3.0.13 AsyncHttpClient versions prior to 2.16.1 Description The AsyncHttpClient library, used by Java applications for asynchronous HTTP requests and responses, contains an issue where the HTTP/1.1...

CVE-2026-107279: Incorrect Implementation of Authentication Algorithm

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. In 3.0.12, a peer offering only Digest qop=auth-int causes mutual-authentication verification to be skipped. AuthenticatorUtils.computeExpectedRspAuth returns no...

PT-2026-107712

Name of the Vulnerable Software and Affected Versions AsyncHttpClient versions prior to 3.0.12 AsyncHttpClient versions prior to 2.16.1 Description The Realm.Builder generates the HTTP Digest client nonce using ThreadLocalRandom instead of a cryptographically secure random source. Because HTTP...

PT-2026-107682

Name of the Vulnerable Software and Affected Versions AsyncHttpClient versions prior to 3.0.12 AsyncHttpClient versions prior to 2.16.1 Description The library incorrectly infers the existence of an HTTP proxy tunnel based on the last request method instead of the result of the CONNECT request. I...

CVE-2026-107232: Cleartext Transmission of Sensitive Information

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 on 3.x and 2.16.1 on 2.x, the client infers that an HTTP proxy tunnel exists from the last request method rather than the CONNECT result. After a pro...

PT-2026-107680

Name of the Vulnerable Software and Affected Versions AsyncHttpClient versions 2.0.0 through 3.0.13 Description Connection-pool partitioning omits identity-defining fields for Kerberos, SPNEGO, NTLM, and authenticated proxy connections. This allows logins without a configured principal, proxy...

PT-2026-107681

Name of the Vulnerable Software and Affected Versions AsyncHttpClient versions prior to 3.0.13 AsyncHttpClient versions prior to 2.16.1 Description The AsyncHttpClient library, used by Java applications for asynchronous HTTP requests and responses, contains an issue where Realm.Builder incorrectl...

CVE-2026-107230: Origin Validation Error

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 3.0.14, connection-pool partitioning still omits identity-defining fields for Kerberos, SPNEGO, NTLM, and authenticated proxy connections. Logins...

CVE-2026-107231: Cleartext Transmission of Sensitive Information

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, Realm.Builder treats a Digest challenge that yields no usable nonce as a Basic challenge. A malicious origin or proxy can label a challen...

PT-2026-107684

Name of the Vulnerable Software and Affected Versions AsyncHttpClient versions prior to 3.0.13 AsyncHttpClient versions prior to 2.16.1 Description The ThreadSafeCookieStore component validates Domain attributes using domain matching but fails to reject public suffixes. This allows a host located...

CVE-2026-107280: Sensitive Cookie with Improper SameSite Attribute

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, ThreadSafeCookieStore validates Domain attributes with domain matching but does not reject public suffixes. A host beneath a suffix such ...

PT-2026-107711

Name of the Vulnerable Software and Affected Versions AsyncHttpClient versions prior to 3.0.13 AsyncHttpClient versions prior to 2.16.1 Description Cross-host request replay occurs when the current request is updated but the target request and related proxy context continue to point to the origin...

PT-2026-107677

Name of the Vulnerable Software and Affected Versions AsyncHttpClient versions 2.2.0 through 3.0.13 Description WebSocket permessage-deflate decompression is unbounded when compression is enabled. The inbound pipeline aggregates compressed frames before the WebSocketClientCompressionHandler...