CVE-2026-107232 AsyncHttpClient: Origin credentials sent in cleartext to a proxy that rejects the CONNECT

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 on 3.x and 2.16.1 on 2.x, the client infers that an HTTP proxy tunnel exists from the last request method rather than the CONNECT result. After a pro...

CVE-2026-85721

A flaw was found in AsyncHttpClient's automatic HTTP response decompression. With automatic decompression enabled the default, the HTTP/1.1 path does not limit the total decompressed response size. A hostile or compromised server, or an attacker able to change a response in transit, can send a...

Linux Distros Unpatched Vulnerability : CVE-2026-85719

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 2.16.1 and...

CVE-2024-53990

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. When making any HTTP request, the automatically enabled and self-managed CookieStore aka cookie jar will silently replace explicitly defined Cookies with any that ha...

CVE-2024-53990 AsyncHttpClient (AHC) library's `CookieStore` replaces explicitly defined `Cookie`s

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. When making any HTTP request, the automatically enabled and self-managed CookieStore aka cookie jar will silently replace explicitly defined Cookies with any that ha...

Insufficient Verification of Data Authenticity in Async Http Client

Async Http Client aka AHC or async-http-client before 1.9.0 skips X.509 certificate verification unless both a keyStore location and a trustStore location are explicitly set, which allows man-in-the-middle attackers to spoof HTTPS servers by presenting an arbitrary certificate during use of a...

GHSA-5C66-6H6G-6Q6M Insufficient Verification of Data Authenticity in Async Http Client

main/java/com/ning/http/client/AsyncHttpClientConfig.java in Async Http Client aka AHC or async-http-client before 1.9.0 does not require a hostname match during verification of X.509 certificates, which allows man-in-the-middle attackers to spoof HTTPS servers via an arbitrary valid certificate...

GHSA-8H53-FJGG-G42G Insufficient Verification of Data Authenticity in Async Http Client

Async Http Client aka AHC or async-http-client before 1.9.0 skips X.509 certificate verification unless both a keyStore location and a trustStore location are explicitly set, which allows man-in-the-middle attackers to spoof HTTPS servers by presenting an arbitrary certificate during use of a...

org.apache.camel.karaf:camel-karaf-commands (2.22.4), org.apache.camel.maven:camel-salesforce-maven-plugin (2.22.4) +567 more potentially affected by CVE-2020-11971 via org.apache.camel:camel-core (2.22.4)

org.apache.camel:camel-core MAVEN version 2.22.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-core and may be impacted: - org.apache.camel.karaf:camel-karaf-commands 2.22.4 - org.apache.camel.maven:camel-salesforce-maven-plugi...

com.bluelock:camel-spring-amqp (1.0), com.osinka.camel:camel-scala-extra_2.8.1 (1.2.4) +138 more potentially affected by CVE-2020-11971 via org.apache.camel:camel-core (2.8.2)

org.apache.camel:camel-core MAVEN version 2.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-core and may be impacted: - com.bluelock:camel-spring-amqp 1.0 - com.osinka.camel:camel-scala-extra2.8.1 1.2.4 -...

org.apache.camel.karaf:camel-karaf-commands (2.16.5), org.apache.camel.karaf:camel-karaf-commands-catalog (2.16.5) +293 more potentially affected by CVE-2020-11971 via org.apache.camel:camel-core (2.16.5)

org.apache.camel:camel-core MAVEN version 2.16.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-core and may be impacted: - org.apache.camel.karaf:camel-karaf-commands 2.16.5 - org.apache.camel.karaf:camel-karaf-commands-catalog...

org.apache.camel.karaf:camel-karaf-commands (2.9.7), org.apache.camel:camel-ahc (2.9.7) +139 more potentially affected by CVE-2020-11971 via org.apache.camel:camel-core (2.9.7)

org.apache.camel:camel-core MAVEN version 2.9.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-core and may be impacted: - org.apache.camel.karaf:camel-karaf-commands 2.9.7 - org.apache.camel:camel-ahc 2.9.7 -...

org.apache.camel:camel-ahc-ws (2.16.0) potentially affected by CVE-2015-5348 via org.apache.camel:camel-ahc (2.16.0)

org.apache.camel:camel-ahc MAVEN version 2.16.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-ahc and may be impacted: - org.apache.camel:camel-ahc-ws 2.16.0 Source cves: CVE-2015-5348 Source advisory: GHSA-26V6-W6FW-RH94...

org.apache.camel:camel-ahc-ws (>=2.14.0, <=2.15.4) potentially affected by CVE-2015-5348 via org.apache.camel:camel-ahc (>=2.14.0, <=2.15.4)

org.apache.camel:camel-ahc MAVEN version =2.14.0, =2.14.0, =2.15.4 Source cves: CVE-2015-5348 Source advisory: OSV:GHSA-26V6-W6FW-RH94...

org.apache.camel:camel-ahc-ws (>=2.14.0, <=2.15.4) potentially affected by CVE-2015-5348 via org.apache.camel:camel-ahc (>=2.14.0, <=2.15.4)

org.apache.camel:camel-ahc MAVEN version =2.14.0, =2.14.0, =2.15.4 Source cves: CVE-2015-5348 Source advisory: GHSA-26V6-W6FW-RH94...

org.apache.camel:camel-ahc-ws (2.16.0) potentially affected by CVE-2015-5348 via org.apache.camel:camel-ahc (2.16.0)

org.apache.camel:camel-ahc MAVEN version 2.16.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-ahc and may be impacted: - org.apache.camel:camel-ahc-ws 2.16.0 Source cves: CVE-2015-5348 Source advisory: OSV:GHSA-26V6-W6FW-RH94...

CVE-2013-7397

Async Http Client (AHC) prior to 1.9.0 fails to verify X.509 certificates unless both a keystore and a truststore are explicitly configured, enabling MITM via spoofed certificates in typical configurations. Affected component is the AHC Java library; exploitation would involve HTTPS usage with mi...

CVE-2013-7398

CVE-2013-7398 affects Async Http Client (async-http-client) before 1.9.0, where hostname verification is not required during X.509 certificate verification. This allows MITM attackers to spoof HTTPS servers with arbitrary valid certificates. Mitigation: upgrade to 1.9.0 or newer (vendor advisorie...

iSupport v1.8 Local file include vulnerability

iSupport v1.8 Local file Inclusion Vuln found by JuMp-Er http://www.ahc-security.org Script Name : iSupport version : 1.8 Vendor Site : http://www.idevspot.com/iSupport.php Exploit : http://www.site.com/iSupport/index.php?includefile=local file 3 StRoNiX, mawena, ML, n0th1ng...