Async Http Client RequestBuilder CookieStore Unauthorized Access

The vulnerability of the RequestBuilder class in the CookieStore interface of the asynchronous HTTP request processing library Async Http Client is related to the replacement of cookie files due to incorrect authentication procedures. Exploiting this vulnerability can allow an attacker operating...

ai.taskmonk:taskmonk-sdk (>=1.7, <=1.16.6), app.peac:core (0.0.1) +2360 more potentially affected by CVE-2024-53990 via org.asynchttpclient:async-http-client (>=2.1.0, <=2.12.3)

org.asynchttpclient:async-http-client MAVEN version =2.1.0, =1.7, =4.1.0, =4.0.0-beta.2, =0.7.0, =0.7.0, =0.1.0, =0.2.0, =0.7.0, =0.7.0, =0.1.0, =0.2.0, =0.9.2 and more Source cves: CVE-2024-53990 Source advisory: OSV:GHSA-MFJ5-CF8G-G2FV...

com.arpnetworking.metrics:mad-experimental (1.2.3), com.arpnetworking.metrics:metrics-aggregator-daemon (>=1.22.2, <=1.22.4) +30 more potentially affected by CVE-2024-53990 via org.asynchttpclient:async-http-client (>=3.0.0.beta1, <=3.0.0)

org.asynchttpclient:async-http-client MAVEN version =3.0.0.beta1, =1.22.2, =1.13.6, =0.0.9, =1.3.13, =1.3.13, =1.3.13, =0.1.0, =0.0.2, =0.0.1-alpha, =0.3.1, =0.3.4 and more Source cves: CVE-2024-53990 Source advisory: OSV:GHSA-MFJ5-CF8G-G2FV...

UBUNTU-CVE-2024-53990

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. When making any HTTP request, the automatically enabled and self-managed CookieStore aka cookie jar will silently replace explicitly defined Cookies with any that ha...

ai.taskmonk:taskmonk-sdk (>=1.7, <=1.16.6), app.peac:core (0.0.1) +2360 more potentially affected by CVE-2024-53990 via org.asynchttpclient:async-http-client (>=2.1.0, <=2.12.3)

org.asynchttpclient:async-http-client MAVEN version =2.1.0, =1.7, =4.1.0, =4.0.0-beta.2, =0.7.0, =0.7.0, =0.1.0, =0.2.0, =0.7.0, =0.7.0, =0.1.0, =0.2.0, =0.9.2 and more Source cves: CVE-2024-53990 Source advisory: MEND:CVE-2024-53990...

Async Http Client Authorization Vulnerability

Async Http Client is AsyncHttpClient open source asynchronous Http and WebSocket client library for Java. An authorization issue vulnerability exists in Async Http Client version 3.0.0, which stems from an automatically enabled and self-managed CookieStore handling mechanism that can lead to...

Security Bulletin: Vulnerability in Async Http Client affects IBM watsonx.data

Summary Async Http Client aka async-http-client could allow a remote attacker to bypass security restrictions, caused by the failure to parse the fragment identifier of the URL when handling '?' character. By using a specially-crafted URL with '?' character, an attacker could exploit this...

Security Bulletin: Vulnerability in Async Http Client affects IBM watsonx.data

Summary Async Http Client aka async-http-client could allow a remote attacker to bypass security restrictions, caused by the failure to parse the fragment identifier of the URL when handling '?' character. By using a specially-crafted URL with '?' character, an attacker could exploit this...

CVE-2024-34364

Envoy is a cloud-native, open source edge and service proxy. Envoy exposed an out-of-memory OOM vector from the mirror response, since async HTTP client will buffer the response with an unbounded buffer...

CVE-2024-34364

Envoy is a cloud-native, open source edge and service proxy. Envoy exposed an out-of-memory OOM vector from the mirror response, since async HTTP client will buffer the response with an unbounded buffer...

CVE-2024-34364: Uncontrolled Resource Consumption

Envoy is a cloud-native, open source edge and service proxy. Envoy exposed an out-of-memory OOM vector from the mirror response, since async HTTP client will buffer the response with an unbounded buffer...

async-http-client:AsyncHttpClientFuzzer: Security exception in java.base/java.lang.Thread.start0

Detailed Report: https://oss-fuzz.com/testcase?key=5534708036141056 Project: async-http-client Fuzzing Engine: libFuzzer Fuzz Target: AsyncHttpClientFuzzer Job Type: libfuzzerasanasync-http-client Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

async-http-client:AsyncHttpClientFuzzer: Security exception with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5981271741038592 Project: async-http-client Fuzzing Engine: libFuzzer Fuzz Target: AsyncHttpClientFuzzer Job Type: libfuzzerasanasync-http-client Platform Id: linux Crash Type: Security exception Crash Address: Crash State: NULL Sanitizer: addres...

GHSA-V3R5-PJPM-MWGQ Async HTTP Client has CRLF Injection vulnerability in HTTP request headers

Versions of Async HTTP Client prior to 1.13.2 are vulnerable to a form of targeted request manipulation called CRLF injection. This vulnerability was the result of insufficient validation of HTTP header field values before sending them to the network. Users are vulnerable if they pass untrusted...

Async HTTP Client has CRLF Injection vulnerability in HTTP request headers

Versions of Async HTTP Client prior to 1.13.2 are vulnerable to a form of targeted request manipulation called CRLF injection. This vulnerability was the result of insufficient validation of HTTP header field values before sending them to the network. Users are vulnerable if they pass untrusted...

Async HTTP Client has CRLF Injection vulnerability in HTTP request headers

Versions of Async HTTP Client prior to 1.13.2 are vulnerable to a form of targeted request manipulation called CRLF injection. This vulnerability was the result of insufficient validation of HTTP header field values before sending them to the network. Users are vulnerable if they pass untrusted...

CVE-2023-0040

Versions of Async HTTP Client prior to 1.13.2 are vulnerable to a form of targeted request manipulation called CRLF injection. This vulnerability was the result of insufficient validation of HTTP header field values before sending them to the network. Users are vulnerable if they pass untrusted...

Crlf injection

Versions of Async HTTP Client prior to 1.13.2 are vulnerable to a form of targeted request manipulation called CRLF injection. This vulnerability was the result of insufficient validation of HTTP header field values before sending them to the network. Users are vulnerable if they pass untrusted...

CVE-2023-0040

Versions of Async HTTP Client prior to 1.13.2 are vulnerable to a form of targeted request manipulation called CRLF injection. This vulnerability was the result of insufficient validation of HTTP header field values before sending them to the network. Users are vulnerable if they pass untrusted...

CVE-2023-0040

Versions of Async HTTP Client prior to 1.13.2 are vulnerable to a form of targeted request manipulation called CRLF injection. This vulnerability was the result of insufficient validation of HTTP header field values before sending them to the network. Users are vulnerable if they pass untrusted...