CVE-2026-107283

The AsyncHttpClient (AHC) library for Java applications is vulnerable to reduced authentication security due to the use of a non-cryptographic random source. In versions prior to 3.0.12 and 2.16.1 , the Realm.Builder component generates the HTTP Digest client nonce using ThreadLocalRandom instead...

CVE-2026-107283 AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random source

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, Realm.Builder generates the HTTP Digest client nonce with ThreadLocalRandom rather than a cryptographically secure random source. Digest...

PT-2026-107712

Name of the Vulnerable Software and Affected Versions AsyncHttpClient versions prior to 3.0.12 AsyncHttpClient versions prior to 2.16.1 Description The Realm.Builder generates the HTTP Digest client nonce using ThreadLocalRandom instead of a cryptographically secure random source. Because HTTP...

CVE-2025-59390-

CVE-2025-59390- El POC adjunto le permitirá descifrar la firma Kerberos en Apache Druid y también cualquier número entero generado por ThreadLocalRandom Advisory - El autenticador Kerberos de Apache Druid utiliza un secreto de respaldo débil cuando la configuración...

CVE-2025-59390: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Apache Druid’s Kerberos authenticator uses a weak fallback secret when the druid.auth.authenticator.kerberos.cookieSignatureSecret configuration is not explicitly set. In this case, the secret is generated using ThreadLocalRandom, which is not a crypto-graphically secure random number generator...

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in Ratpack

Ratpack versions before 1.6.1 generate a session ID using a cryptographically weak PRNG in the JDK's ThreadLocalRandom. This means that if an attacker can determine a small window for the server start time and obtain a session ID value, they can theoretically determine the sequence of session IDs...

CVE-2019-11808

Ratpack versions before 1.6.1 generate a session ID using a cryptographically weak PRNG in the JDK's ThreadLocalRandom. This means that if an attacker can determine a small window for the server start time and obtain a session ID value, they can theoretically determine the sequence of session IDs...

Design/Logic Flaw

Ratpack versions before 1.6.1 generate a session ID using a cryptographically weak PRNG in the JDK's ThreadLocalRandom. This means that if an attacker can determine a small window for the server start time and obtain a session ID value, they can theoretically determine the sequence of session IDs...

CVE-2019-11808

Ratpack versions before 1.6.1 generate a session ID using a cryptographically weak PRNG in the JDK's ThreadLocalRandom. This means that if an attacker can determine a small window for the server start time and obtain a session ID value, they can theoretically determine the sequence of session IDs...

CVE-2019-11808

Ratpack versions before 1.6.1 generate a session ID using a cryptographically weak PRNG in the JDK's ThreadLocalRandom. This means that if an attacker can determine a small window for the server start time and obtain a session ID value, they can theoretically determine the sequence of session IDs...

CVE-2019-11808: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Ratpack versions before 1.6.1 generate a session ID using a cryptographically weak PRNG in the JDK's ThreadLocalRandom. This means that if an attacker can determine a small window for the server start time and obtain a session ID value, they can theoretically determine the sequence of session IDs...