17 matches found
GHSA-RQF5-2WXV-RJF4 AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext
Impact A Digest challenge that does not yield a usable nonce is treated as a Basic challenge. The client then answers it with Authorization: Basic, which carries the username and password base64 encoded and so recoverable by anyone who sees the request. Any of these is enough, sent by whoever...
EUVD-2026-94636
AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext...
AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext
Impact A Digest challenge that does not yield a usable nonce is treated as a Basic challenge. The client then answers it with Authorization: Basic, which carries the username and password base64 encoded and so recoverable by anyone who sees the request. Any of these is enough, sent by whoever...
Linux Distros Unpatched Vulnerability : CVE-2026-107231
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1,...
DEBIAN-CVE-2026-107231
The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, Realm.Builder treats a Digest challenge that yields no usable nonce as a Basic challenge. A malicious origin or proxy can label a challen...
CVE-2026-107231
The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, Realm.Builder treats a Digest challenge that yields no usable nonce as a Basic challenge. A malicious origin or proxy can label a challen...
CVE-2026-107231
The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, Realm.Builder treats a Digest challenge that yields no usable nonce as a Basic challenge. A malicious origin or proxy can label a challen...
Cleartext Transmission of Sensitive Information
Overview org.asynchttpclient:async-http-client is a maven plugin for the Async Http Client AHC classes. Affected versions of this package are vulnerable to Cleartext Transmission of Sensitive Information in the Realm.Builder process when a Digest challenge is received without a usable nonce,...
CVE-2026-107231
The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, Realm.Builder treats a Digest challenge that yields no usable nonce as a Basic challenge. A malicious origin or proxy can label a challen...
CVE-2026-107231 AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext
The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, Realm.Builder treats a Digest challenge that yields no usable nonce as a Basic challenge. A malicious origin or proxy can label a challen...
CVE-2026-107231
The AsyncHttpClient (AHC) library for Java applications is vulnerable to an authentication downgrade attack in versions prior to 3.0.13 and 2.16.1 . The Realm.Builder component incorrectly treats a Digest challenge that lacks a usable nonce as a Basic challenge . An attacker controlling a proxy o...
CVE-2026-107231 AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext
The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, Realm.Builder treats a Digest challenge that yields no usable nonce as a Basic challenge. A malicious origin or proxy can label a challen...
CVE-2026-107231
The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, Realm.Builder treats a Digest challenge that yields no usable nonce as a Basic challenge. A malicious origin or proxy can label a challen...
CVE-2026-107231 AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext
The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, Realm.Builder treats a Digest challenge that yields no usable nonce as a Basic challenge. A malicious origin or proxy can label a challen...
CVE-2026-107231: Cleartext Transmission of Sensitive Information
The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, Realm.Builder treats a Digest challenge that yields no usable nonce as a Basic challenge. A malicious origin or proxy can label a challen...
PT-2026-107681
Name of the Vulnerable Software and Affected Versions AsyncHttpClient versions prior to 3.0.13 AsyncHttpClient versions prior to 2.16.1 Description The AsyncHttpClient library, used by Java applications for asynchronous HTTP requests and responses, contains an issue where Realm.Builder incorrectl...
libmicrohttpd2:fuzz_response: Heap-buffer-overflow in response_add_auth_digest_challenge_alg
Detailed Report: https://oss-fuzz.com/testcase?key=6279829306802176 Project: libmicrohttpd2 Fuzzing Engine: libFuzzer Fuzz Target: fuzzresponse Job Type: libfuzzerasanlibmicrohttpd2 Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 15 Crash Address: 0x5110000003a0 Crash State:...