EUVD-2025-211004

The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it...

CVE-2025-14181 Integer overflow to buffer overflow in soap HTTP parsing

The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it...

CVE-2025-14181

The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it...

CVE-2025-14181 Integer overflow to buffer overflow in soap HTTP parsing

The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it...

CVE-2025-14181

The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it...

PT-2026-99116

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The SOAP HTTP client contains a flaw in how it manages response buffer growth. The system uses a check based on signed integer overflow, which is considered...

CVE-2025-14181: Integer Overflow or Wraparound

The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it...

[SECURITY] Fedora 43 Update: nodejs-undici-7.29.0-3.fc43

An HTTP/1.1 client, written from scratch for Node.js...

ai.evolv:ascend-sdk (0.5.0), ai.taskmonk:taskmonk-sdk (>=1.7, <=1.16.6) +2878 more potentially affected by CVE-2026-85719 via org.asynchttpclient:async-http-client (>=2.0.0-alpha13, <=2.16.0)

org.asynchttpclient:async-http-client MAVEN version =2.0.0-alpha13, =1.7, =4.1.0, =4.2.14, =4.1.0, =4.1.0, =4.1.0, =4.2.14, =3.5.5, =3.5.5, =3.5.5, =3.5.7-jre7.0 and more Source cves: CVE-2026-85719 Source advisory: SNYK:JAVA-ORGASYNCHTTPCLIENT-19963949...

com.akamai.edgegrid:edgegrid-signer-async-http-client (>=6.0.1-rc.1, <=6.0.5), com.arpnetworking.metrics:mad-experimental (>=1.2.3, <=1.2.11) +101 more potentially affected by CVE-2026-85719 via org.asynchttpclient:async-http-client (>=3.0.0.beta1, <=3.0.11)

org.asynchttpclient:async-http-client MAVEN version =3.0.0.beta1, =6.0.1-rc.1, =1.2.3, =1.22.2, =1.13.6, =1.1.0, =0.4.7, =0.4.7, =0.4.7, =1.17.0, =1.17.0, =1.17.0, =0.5.0, =0.0.9, =0.0.11 and more Source cves: CVE-2026-85719 Source advisory: SNYK:JAVA-ORGASYNCHTTPCLIENT-19963949...

Cleartext Transmission of Sensitive Information

Overview org.asynchttpclient:async-http-client is a maven plugin for the Async Http Client AHC classes. Affected versions of this package are vulnerable to Cleartext Transmission of Sensitive Information through proxy-auth handling in NettyRequestFactory.newNettyRequest and...

com.akamai.edgegrid:edgegrid-signer-async-http-client (>=6.0.4-rc1, <=6.0.5), com.cloudbees.thirdparty:zendesk-java-client (>=1.5.0, <=1.6.1) +43 more potentially affected by CVE-2026-85718 via org.asynchttpclient:async-http-client (>=3.0.9, <=3.0.11)

org.asynchttpclient:async-http-client MAVEN version =3.0.9, =6.0.4-rc1, =1.5.0, =5.0.0, =5.0.0, =1.17.15, =1.17.15, =1.17.15, =252.1.0, =11.2.1, =2.0.0, =4.20.0, =4.20.0, =4.23.0 and more Source cves: CVE-2026-85718 Source advisory: SNYK:JAVA-ORGASYNCHTTPCLIENT-19963950...

Improper Resource Shutdown or Release

Overview org.asynchttpclient:async-http-client is a maven plugin for the Async Http Client AHC classes. Affected versions of this package are vulnerable to Improper Resource Shutdown or Release due to NettyConnectListener.onSuccess in the Netty connect path. An attacker can exhaust maxConnections...

com.akamai.edgegrid:edgegrid-signer-async-http-client (>=6.0.4-rc1, <=6.0.5), com.cloudbees.thirdparty:zendesk-java-client (>=1.5.0, <=1.6.1) +43 more potentially affected by CVE-2026-85717 via org.asynchttpclient:async-http-client (>=3.0.9, <=3.0.11)

org.asynchttpclient:async-http-client MAVEN version =3.0.9, =6.0.4-rc1, =1.5.0, =5.0.0, =5.0.0, =1.17.15, =1.17.15, =1.17.15, =252.1.0, =11.2.1, =2.0.0, =4.20.0, =4.20.0, =4.23.0 and more Source cves: CVE-2026-85717 Source advisory: OSV:GHSA-F8M2-889X-VW4X...

be.wegenenverkeer:rxhttpclient (2.0.1), be.wegenenverkeer:rxhttpclient-fs2_2.13 (2.0.1) +103 more potentially affected by CVE-2026-85717 via org.asynchttpclient:async-http-client (>=2.14.5, <=2.16.0)

org.asynchttpclient:async-http-client MAVEN version =2.14.5, =3.0.18.0, =3.0.18.0, =3.0.18.0, =3.0.18.0, =3.0.18.0, =3.0.18.0, =3.0.18.0, =3.0.18.0, =3.0.18.0, =3.0.18.0, =3.0.18.0, =3.0.18.0, =4.0.14.0 and more Source cves: CVE-2026-85717 Source advisory: SNYK:JAVA-ORGASYNCHTTPCLIENT-19963951...

be.wegenenverkeer:rxhttpclient (2.0.1), be.wegenenverkeer:rxhttpclient-fs2_2.13 (2.0.1) +103 more potentially affected by CVE-2026-85717 via org.asynchttpclient:async-http-client (>=2.14.5, <=2.16.0)

org.asynchttpclient:async-http-client MAVEN version =2.14.5, =3.0.18.0, =3.0.18.0, =3.0.18.0, =3.0.18.0, =3.0.18.0, =3.0.18.0, =3.0.18.0, =3.0.18.0, =3.0.18.0, =3.0.18.0, =3.0.18.0, =3.0.18.0, =4.0.14.0 and more Source cves: CVE-2026-85717 Source advisory: GHSA-F8M2-889X-VW4X...

com.akamai.edgegrid:edgegrid-signer-async-http-client (>=6.0.4-rc1, <=6.0.5), com.cloudbees.thirdparty:zendesk-java-client (>=1.5.0, <=1.6.1) +43 more potentially affected by CVE-2026-85717 via org.asynchttpclient:async-http-client (>=3.0.9, <=3.0.11)

org.asynchttpclient:async-http-client MAVEN version =3.0.9, =6.0.4-rc1, =1.5.0, =5.0.0, =5.0.0, =1.17.15, =1.17.15, =1.17.15, =252.1.0, =11.2.1, =2.0.0, =4.20.0, =4.20.0, =4.23.0 and more Source cves: CVE-2026-85717 Source advisory: GHSA-F8M2-889X-VW4X...

com.akamai.edgegrid:edgegrid-signer-async-http-client (>=6.0.4-rc1, <=6.0.5), com.cloudbees.thirdparty:zendesk-java-client (>=1.5.0, <=1.6.1) +43 more potentially affected by CVE-2026-85717 via org.asynchttpclient:async-http-client (>=3.0.9, <=3.0.11)

org.asynchttpclient:async-http-client MAVEN version =3.0.9, =6.0.4-rc1, =1.5.0, =5.0.0, =5.0.0, =1.17.15, =1.17.15, =1.17.15, =252.1.0, =11.2.1, =2.0.0, =4.20.0, =4.20.0, =4.23.0 and more Source cves: CVE-2026-85717 Source advisory: SNYK:JAVA-ORGASYNCHTTPCLIENT-19963951...

be.wegenenverkeer:rxhttpclient (2.0.1), be.wegenenverkeer:rxhttpclient-fs2_2.13 (2.0.1) +103 more potentially affected by CVE-2026-85717 via org.asynchttpclient:async-http-client (>=2.14.5, <=2.16.0)

org.asynchttpclient:async-http-client MAVEN version =2.14.5, =3.0.18.0, =3.0.18.0, =3.0.18.0, =3.0.18.0, =3.0.18.0, =3.0.18.0, =3.0.18.0, =3.0.18.0, =3.0.18.0, =3.0.18.0, =3.0.18.0, =3.0.18.0, =4.0.14.0 and more Source cves: CVE-2026-85717 Source advisory: OSV:GHSA-F8M2-889X-VW4X...

Insufficiently Protected Credentials

Overview org.asynchttpclient:async-http-client is a maven plugin for the Async Http Client AHC classes. Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the redirect authentication path in Interceptors.java. An attacker can obtain client-wide realm...