com.akamai.edgegrid:edgegrid-signer-async-http-client (>=6.0.4-rc1, <=6.0.5), com.cloudbees.thirdparty:zendesk-java-client (>=1.5.0, <=1.6.1) +43 more potentially affected by CVE-2026-85716 via org.asynchttpclient:async-http-client (>=3.0.9, <=3.0.11)

org.asynchttpclient:async-http-client MAVEN version =3.0.9, =6.0.4-rc1, =1.5.0, =5.0.0, =5.0.0, =1.17.15, =1.17.15, =1.17.15, =252.1.0, =11.2.1, =2.0.0, =4.20.0, =4.20.0, =4.23.0 and more Source cves: CVE-2026-85716 Source advisory: OSV:GHSA-FJ9W-C36G-H5X8...

com.akamai.edgegrid:edgegrid-signer-async-http-client (>=6.0.4-rc1, <=6.0.5), com.cloudbees.thirdparty:zendesk-java-client (>=1.5.0, <=1.6.1) +43 more potentially affected by CVE-2026-85716 via org.asynchttpclient:async-http-client (>=3.0.9, <=3.0.11)

org.asynchttpclient:async-http-client MAVEN version =3.0.9, =6.0.4-rc1, =1.5.0, =5.0.0, =5.0.0, =1.17.15, =1.17.15, =1.17.15, =252.1.0, =11.2.1, =2.0.0, =4.20.0, =4.20.0, =4.23.0 and more Source cves: CVE-2026-85716 Source advisory: MEND:CVE-2026-85716...

ai.evolv:ascend-sdk (0.5.0), ai.taskmonk:taskmonk-sdk (>=1.7, <=1.16.6) +2859 more potentially affected by CVE-2026-85721 via org.asynchttpclient:async-http-client (>=2.0.0, <=2.16.0)

org.asynchttpclient:async-http-client MAVEN version =2.0.0, =1.7, =4.1.0, =4.2.14, =4.1.0, =4.1.0, =4.1.0, =4.2.14, =3.5.5, =3.5.5, =3.5.5, =3.5.7-jre7.0 and more Source cves: CVE-2026-85721 Source advisory: MEND:CVE-2026-85721...

com.akamai.edgegrid:edgegrid-signer-async-http-client (>=6.0.4-rc1, <=6.0.5), com.cloudbees.thirdparty:zendesk-java-client (>=1.5.0, <=1.6.1) +43 more potentially affected by CVE-2026-85717 via org.asynchttpclient:async-http-client (>=3.0.9, <=3.0.11)

org.asynchttpclient:async-http-client MAVEN version =3.0.9, =6.0.4-rc1, =1.5.0, =5.0.0, =5.0.0, =1.17.15, =1.17.15, =1.17.15, =252.1.0, =11.2.1, =2.0.0, =4.20.0, =4.20.0, =4.23.0 and more Source cves: CVE-2026-85717 Source advisory: MEND:CVE-2026-85717...

ai.taskmonk:taskmonk-sdk (>=1.7, <=1.16.6), app.peac:core (0.0.1) +2425 more potentially affected by CVE-2026-85719 via org.asynchttpclient:async-http-client (>=2.1.0, <=2.16.0)

org.asynchttpclient:async-http-client MAVEN version =2.1.0, =1.7, =4.1.0, =4.0.0-beta.2, =0.7.0, =0.7.0, =0.1.0, =0.2.0, =0.7.0, =0.7.0, =0.1.0, =0.2.0, =0.9.2 and more Source cves: CVE-2026-85719 Source advisory: MEND:CVE-2026-85719...

ai.evolv:ascend-sdk (0.5.0), ai.taskmonk:taskmonk-sdk (>=1.7, <=1.16.6) +2858 more potentially affected by CVE-2026-55688 via org.asynchttpclient:async-http-client (>=2.0.0, <=2.15.0)

org.asynchttpclient:async-http-client MAVEN version =2.0.0, =1.7, =4.1.0, =4.2.14, =4.1.0, =4.1.0, =4.1.0, =4.2.14, =3.5.5, =3.5.5, =3.5.5, =3.5.7-jre7.0 and more Source cves: CVE-2026-55688 Source advisory: OSV:GHSA-M452-Q8C9-RG2F...

com.akamai.edgegrid:edgegrid-signer-async-http-client (>=6.0.1-rc.1, <=6.0.4), com.arpnetworking.metrics:mad-experimental (>=1.2.3, <=1.2.11) +96 more potentially affected by CVE-2026-55688 via org.asynchttpclient:async-http-client (>=3.0.0.beta1, <=3.0.10)

org.asynchttpclient:async-http-client MAVEN version =3.0.0.beta1, =6.0.1-rc.1, =1.2.3, =1.22.2, =1.13.6, =1.1.0, =0.4.7, =0.4.7, =0.4.7, =1.17.0, =1.17.0, =1.17.0, =0.5.0, =0.0.9, =2.7.3, =2.9.0 and more Source cves: CVE-2026-55688 Source advisory: OSV:GHSA-M452-Q8C9-RG2F...

com.akamai.edgegrid:edgegrid-signer-async-http-client (>=6.0.1-rc.1, <=6.0.4), com.arpnetworking.metrics:mad-experimental (>=1.2.3, <=1.2.11) +96 more potentially affected by CVE-2026-55688 via org.asynchttpclient:async-http-client (>=3.0.0.beta1, <=3.0.10)

org.asynchttpclient:async-http-client MAVEN version =3.0.0.beta1, =6.0.1-rc.1, =1.2.3, =1.22.2, =1.13.6, =1.1.0, =0.4.7, =0.4.7, =0.4.7, =1.17.0, =1.17.0, =1.17.0, =0.5.0, =0.0.9, =2.7.3, =2.9.0 and more Source cves: CVE-2026-55688 Source advisory: GHSA-M452-Q8C9-RG2F...

[SECURITY] [DLA 4721-1] async-http-client security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4721-1 [email protected] https://www.debian.org/lts/security/ Chris Lamb August 06, 2026 https://wiki.debian.org/LTS -...

Debian dla-4721 : libasync-http-client-java - security update

The remote Debian 11 / 12 host has a package installed that is affected by a vulnerability as referenced in the dla-4721 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4721-1 [email protected]...

SUSE SLED15 / SLES15 Security Update : python-tornado6 (SUSE-SU-2026:3155-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3155-1 advisory. This update for python-tornado6 fixes the following issue - GHSA-pw6j-qg29-8w7f: CurlAsyncHTTPClient leaks per-request...

Malicious code in async-http-tools (PyPI)

Source: kam193 85e8a68bad6595a817f1dabed757662e2a04cfec7b45a86d9bfd61a7a78d14d1 During installation, package exfiltrates some basic info to a GitHub issue comment, and then attempt to set up a persistent infostealer focused on exfiltrating crypto wallets and browsers data. Likely continuation of...

CVE-2026-49855

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, Tornado gzip decompression routines processed limited-size chunks but did not enforce an overall limit on accumulated decompressed chunks, allowing a malicious server accessed by SimpleAsyncHTTPClient or an...

CVE-2026-49855 tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb)

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, Tornado gzip decompression routines processed limited-size chunks but did not enforce an overall limit on accumulated decompressed chunks, allowing a malicious server accessed by SimpleAsyncHTTPClient or an...

EUVD-2026-44503

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHTTPClient shallow-copied redirected requests and removed only the Host header, leaving Authorization, authusername, authpassword, and authmode in place when a redirect changed scheme, host, or port...

PT-2026-60003

Tornado's gzip decompression routines work in limited-size chunks, but have no overall limit for the total size of decompressed chunks that they will accumulate There has always been a limit for the total compressed size. This allows a malicious server to consume effectively unlimited amounts of...

CVE-2026-55688

A flaw was found in the AsyncHttpClient AHC library. The ThreadSafeCookieStore component did not properly verify the domain attribute of cookies, allowing a malicious host to set a cookie for an unrelated domain. This cookie would then be sent by the client in subsequent requests to the targeted...

DEBIAN-CVE-2026-55688

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. In versions from 2.0.0 prior to 2.16.0 and from 3.0.0.Beta1 prior to 3.0.11, ThreadSafeCookieStore stored a cookie under the value of its Domain attribute without...

CVE-2026-55688

Affected software: AsyncHttpClient (AHC) library for Java. Vulnerable versions: 2.0.0 up to (but not including) 2.16.0, and 3.0.0.Beta1 up to (but not including) 3.0.11. Root cause: ThreadSafeCookieStore may store a cookie using the.Domain value without validating that the responding host is allo...

GHSA-MGF9-4VPG-HJ56 tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb)

Tornado's gzip decompression routines work in limited-size chunks, but have no overall limit for the total size of decompressed chunks that they will accumulate There has always been a limit for the total compressed size. This allows a malicious server to consume effectively unlimited amounts of...