async-http-client-check

async-http-client-check Offline checker for the 26 repository-level security advisories oforg.asynchttpclient:async-http-client AsyncHttpClient, "AHC". It tells you which ones your jar is actually exposed to, flags the ones Dependabot and OSV cannot see , and gives one answer per line: 3.x →3.0.1...

CVE-2026-107284

A flaw was found in async-http-client. When initiating a WebSocket connection, the client aborts handshakes that have missing or invalid validation headers but still proceeds to initialize the processing pipeline. A malicious server can exploit this issue by bundling data frames with an invalid...

CVE-2026-107285

A flaw was found in async-http-client. When establishing a proxied WebSocket connection through an HTTP tunnel, the client improperly includes proxy authentication headers in the request sent to the destination server. A remote origin server can capture these credentials, leading to information...

Sensitive Information Disclosure

org.asynchttpclient, async-http-client is vulnerable to sensitive information disclosure. The vulnerability is due to improper handling of proxy authentication headers when using an authenticated SOCKS proxy, which allows an attacker-controlled origin to obtain proxy credentials, including Basic,...

Uncontrolled Resource Consumption

org.asynchttpclient, async-http-client is vulnerable to uncontrolled resource consumption. The vulnerability is due to connection permits not being released when TLS connection establishment fails, which allows an attacker to trigger repeated connection failures and exhaust the available connecti...

aio-libs Async HTTP client/server framework Resource management error vulnerability

The aio-libs Async HTTP client/server framework versions prior to 3.14.4 have a resource management error vulnerability. This vulnerability stems from the Max-Age mechanism, which may cause overflows and skip closing connections. This could allow attackers to temporarily exhaust the connection po...

aio-libs Async HTTP client/server framework Resource management error vulnerability

The aio-libs Async HTTP client/server framework versions prior to 3.14.4 have a resource management error vulnerability. This vulnerability stems from the lack of keepalive timeout handling during the initial request phase. Attackers can keep idle connections open without sending request data,...

aio-libs Async HTTP client/server framework: Input validation error vulnerability

The aio-libs Async HTTP client/server framework versions prior to 3.14.4 have a vulnerability related to input validation errors. This vulnerability stems from the use of a pure Python parser that accepts ambiguous HTTP request frames. This could allow unvalidated attackers to inject HTTP request...

aio-libs Async HTTP client/server framework: Input validation error vulnerability

The aio-libs Async HTTP client/server framework versions prior to 3.14.4 have a vulnerability related to input validation errors. This vulnerability arises when an attacker can send an absolute-form request, causing Request.scheme to use the request-target scheme data controlled by the attacker...

com.akamai.edgegrid:edgegrid-signer-async-http-client (>=6.0.1-rc.1, <=6.0.5), com.arpnetworking.metrics:mad-experimental (>=1.2.3, <=1.2.11) +98 more potentially affected by CVE-2026-107226 via org.asynchttpclient:async-http-client (>=3.0.0, <=3.0.13)

org.asynchttpclient:async-http-client MAVEN version =3.0.0, =6.0.1-rc.1, =1.2.3, =1.22.2, =1.13.6, =1.1.0, =2.0.0, =0.4.7, =0.4.7, =0.4.7, =1.17.0, =1.17.0, =1.17.0, =0.5.0, =0.0.9, =0.0.11 and more Source cves: CVE-2026-107226 Source advisory: MEND:CVE-2026-107226...

com.akamai.edgegrid:edgegrid-signer-async-http-client (>=6.0.1-rc.1, <=6.0.5), com.arpnetworking.metrics:mad-experimental (>=1.2.3, <=1.2.11) +98 more potentially affected by CVE-2024-53990 +1 more via org.asynchttpclient:async-http-client (>=3.0.0, <=3.0.13)

org.asynchttpclient:async-http-client MAVEN version =3.0.0, =6.0.1-rc.1, =1.2.3, =1.22.2, =1.13.6, =1.1.0, =2.0.0, =0.4.7, =0.4.7, =0.4.7, =1.17.0, =1.17.0, =1.17.0, =0.5.0, =0.0.9, =0.0.11 and more Source cves: CVE-2024-53990, CVE-2026-107228 Source advisory: OSV:GHSA-2JWH-9RMR-J4XFhttps://...

com.akamai.edgegrid:edgegrid-signer-async-http-client (>=6.0.1-rc.1, <=6.0.5), com.arpnetworking.metrics:mad-experimental (>=1.2.3, <=1.2.11) +98 more potentially affected by CVE-2024-53990 +1 more via org.asynchttpclient:async-http-client (>=3.0.0, <=3.0.13)

org.asynchttpclient:async-http-client MAVEN version =3.0.0, =6.0.1-rc.1, =1.2.3, =1.22.2, =1.13.6, =1.1.0, =2.0.0, =0.4.7, =0.4.7, =0.4.7, =1.17.0, =1.17.0, =1.17.0, =0.5.0, =0.0.9, =0.0.11 and more Source cves: CVE-2024-53990, CVE-2026-107228 Source advisory: GHSA-2JWH-9RMR-J4XFhttps://vuln...

com.akamai.edgegrid:edgegrid-signer-async-http-client (>=6.0.1-rc.1, <=6.0.5), com.arpnetworking.metrics:mad-experimental (>=1.2.3, <=1.2.11) +98 more potentially affected by CVE-2026-107226 via org.asynchttpclient:async-http-client (>=3.0.0, <=3.0.13)

org.asynchttpclient:async-http-client MAVEN version =3.0.0, =6.0.1-rc.1, =1.2.3, =1.22.2, =1.13.6, =1.1.0, =2.0.0, =0.4.7, =0.4.7, =0.4.7, =1.17.0, =1.17.0, =1.17.0, =0.5.0, =0.0.9, =0.0.11 and more Source cves: CVE-2026-107226 Source advisory: GHSA-P2JM-6HJ6-9RJG...

com.akamai.edgegrid:edgegrid-signer-async-http-client (>=6.0.1-rc.1, <=6.0.5), com.arpnetworking.metrics:mad-experimental (>=1.2.3, <=1.2.11) +98 more potentially affected by CVE-2026-107227 via org.asynchttpclient:async-http-client (>=3.0.0, <=3.0.13)

org.asynchttpclient:async-http-client MAVEN version =3.0.0, =6.0.1-rc.1, =1.2.3, =1.22.2, =1.13.6, =1.1.0, =2.0.0, =0.4.7, =0.4.7, =0.4.7, =1.17.0, =1.17.0, =1.17.0, =0.5.0, =0.0.9, =0.0.11 and more Source cves: CVE-2026-107227 Source advisory: OSV:GHSA-X8V2-478Q-2HVG...

com.akamai.edgegrid:edgegrid-signer-async-http-client (>=6.0.1-rc.1, <=6.0.5), com.arpnetworking.metrics:mad-experimental (>=1.2.3, <=1.2.11) +98 more potentially affected by CVE-2026-107227 via org.asynchttpclient:async-http-client (>=3.0.0, <=3.0.13)

org.asynchttpclient:async-http-client MAVEN version =3.0.0, =6.0.1-rc.1, =1.2.3, =1.22.2, =1.13.6, =1.1.0, =2.0.0, =0.4.7, =0.4.7, =0.4.7, =1.17.0, =1.17.0, =1.17.0, =0.5.0, =0.0.9, =0.0.11 and more Source cves: CVE-2026-107227 Source advisory: GHSA-X8V2-478Q-2HVG...

ai.taskmonk:taskmonk-sdk (>=1.7, <=1.16.6), app.peac:core (0.0.1) +2426 more potentially affected by CVE-2026-107227 via org.asynchttpclient:async-http-client (>=2.2.0, <=2.16.1)

org.asynchttpclient:async-http-client MAVEN version =2.2.0, =1.7, =4.1.0, =4.0.0-beta.2, =0.7.0, =0.7.0, =0.1.0, =0.2.0, =0.7.0, =0.7.0, =0.1.0, =0.2.0, =0.9.2 and more Source cves: CVE-2026-107227 Source advisory: OSV:GHSA-X8V2-478Q-2HVG...

ai.evolv:ascend-sdk (0.5.0), ai.taskmonk:taskmonk-sdk (>=1.7, <=1.16.6) +2866 more potentially affected by CVE-2026-107283 via org.asynchttpclient:async-http-client (>=2.0.0, <=2.16.0)

org.asynchttpclient:async-http-client MAVEN version =2.0.0, =1.7, =4.1.0, =4.2.14, =4.1.0, =4.1.0, =4.1.0, =4.2.14, =3.5.5, =3.5.5, =3.5.5, =3.5.7-jre7.0 and more Source cves: CVE-2026-107283 Source advisory: GHSA-MFJ3-87QQ-382V...

com.akamai.edgegrid:edgegrid-signer-async-http-client (>=6.0.1-rc.1, <=6.0.5), com.arpnetworking.metrics:mad-experimental (>=1.2.3, <=1.2.11) +96 more potentially affected by CVE-2026-107283 via org.asynchttpclient:async-http-client (>=3.0.0, <=3.0.11)

org.asynchttpclient:async-http-client MAVEN version =3.0.0, =6.0.1-rc.1, =1.2.3, =1.22.2, =1.13.6, =1.1.0, =0.4.7, =0.4.7, =0.4.7, =1.17.0, =1.17.0, =1.17.0, =0.5.0, =0.0.9, =0.0.11 and more Source cves: CVE-2026-107283 Source advisory: OSV:GHSA-MFJ3-87QQ-382V...

ai.evolv:ascend-sdk (0.5.0), ai.taskmonk:taskmonk-sdk (>=1.7, <=1.16.6) +2866 more potentially affected by CVE-2026-107283 via org.asynchttpclient:async-http-client (>=2.0.0, <=2.16.0)

org.asynchttpclient:async-http-client MAVEN version =2.0.0, =1.7, =4.1.0, =4.2.14, =4.1.0, =4.1.0, =4.1.0, =4.2.14, =3.5.5, =3.5.5, =3.5.5, =3.5.7-jre7.0 and more Source cves: CVE-2026-107283 Source advisory: OSV:GHSA-MFJ3-87QQ-382V...

ai.evolv:ascend-sdk (0.5.0), ai.taskmonk:taskmonk-sdk (>=1.7, <=1.16.6) +2866 more potentially affected by CVE-2026-107285 via org.asynchttpclient:async-http-client (>=2.0.0, <=2.16.0)

org.asynchttpclient:async-http-client MAVEN version =2.0.0, =1.7, =4.1.0, =4.2.14, =4.1.0, =4.1.0, =4.1.0, =4.2.14, =3.5.5, =3.5.5, =3.5.5, =3.5.7-jre7.0 and more Source cves: CVE-2026-107285 Source advisory: OSV:GHSA-3WP9-XFWM-RJJF...