325 matches found
Authentication Downgrade
AsyncHttpClient is vulnerable to Authentication Downgrade. The vulnerability is due to improper handling of Digest authentication challenges with missing or empty nonces, which allows a malicious origin or proxy to downgrade authentication to Basic and obtain the user's username and password in a...
EUVD-2026-94589
AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader Bypass of CVE-2024-53990 Fix...
GHSA-2JWH-9RMR-J4XF AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader (Bypass of CVE-2024-53990 Fix)
Impact With the cookie store enabled, which is the default, a Cookie header that the caller sets on a request with setHeader or addHeader is thrown away whenever the store holds any cookie for the request's origin: the request's cookie list is written into that header afterwards and replaces it...
AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader (Bypass of CVE-2024-53990 Fix)
Impact With the cookie store enabled, which is the default, a Cookie header that the caller sets on a request with setHeader or addHeader is thrown away whenever the store holds any cookie for the request's origin: the request's cookie list is written into that header afterwards and replaces it...
AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPS
Impact The cookie store ignores the scheme a Set-Cookie arrived on. draft-ietf-httpbis-rfc6265bis-22 approved to obsolete RFC 6265, in the RFC Editor queue Section 5.7 requires a user agent to ignore a cookie with the Secure attribute unless it arrived over a secure connection step 13, and to...
GHSA-P2JM-6HJ6-9RJG AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPS
Impact The cookie store ignores the scheme a Set-Cookie arrived on. draft-ietf-httpbis-rfc6265bis-22 approved to obsolete RFC 6265, in the RFC Editor queue Section 5.7 requires a user agent to ignore a cookie with the Secure attribute unless it arrived over a secure connection step 13, and to...
AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabled
Impact With WebSocket compression enabled, the client inflates permessage-deflate messages with no limit on the decompressed size. It installed Netty's shared WebSocketClientCompressionHandler.INSTANCE, whose inflater is unbounded, and webSocketMaxFrameSize and webSocketMaxBufferSize only bound t...
EUVD-2026-94588
AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabled...
GHSA-X8V2-478Q-2HVG AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabled
Impact With WebSocket compression enabled, the client inflates permessage-deflate messages with no limit on the decompressed size. It installed Netty's shared WebSocketClientCompressionHandler.INSTANCE, whose inflater is unbounded, and webSocketMaxFrameSize and webSocketMaxBufferSize only bound t...
EUVD-2026-94635
AsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy logins...
AsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy logins
Impact The fix for GHSA-vvp4-63h8-v5pm in 3.0.13 folded the authenticated principal into the HTTP/1.1 connection pool key, so that a connection one principal authenticated with NTLM, Kerberos or SPNEGO is not handed to another. It left three cases out. In each, a socket that one identity...
GHSA-V2J5-22FR-J62R AsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy logins
Impact The fix for GHSA-vvp4-63h8-v5pm in 3.0.13 folded the authenticated principal into the HTTP/1.1 connection pool key, so that a connection one principal authenticated with NTLM, Kerberos or SPNEGO is not handed to another. It left three cases out. In each, a socket that one identity...
AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random source
Impact The client nonce used in HTTP Digest authentication was generated from ThreadLocalRandom, a fast but non-cryptographic pseudorandom number generator. RFC 7616 section 3.3 requires the cnonce to be unpredictable, since it is part of what protects the Digest exchange against chosen-plaintext...
EUVD-2026-94643
AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random source...
GHSA-MFJ3-87QQ-382V AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random source
Impact The client nonce used in HTTP Digest authentication was generated from ThreadLocalRandom, a fast but non-cryptographic pseudorandom number generator. RFC 7616 section 3.3 requires the cnonce to be unpredictable, since it is part of what protects the Digest exchange against chosen-plaintext...
EUVD-2026-94645
AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel...
AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel
Impact When a ws:// request is routed through an HTTP proxy with proxy authentication configured, the client tunnels the connection with an HTTP CONNECT, the same as it does for https://. Once the tunnel is open, the WebSocket upgrade request that follows is sent through the tunnel directly to th...
GHSA-3WP9-XFWM-RJJF AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel
Impact When a ws:// request is routed through an HTTP proxy with proxy authentication configured, the client tunnels the connection with an HTTP CONNECT, the same as it does for https://. Once the tunnel is open, the WebSocket upgrade request that follows is sent through the tunnel directly to th...
AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.uk
Impact The cookie store decides whether a Domain attribute may be accepted using only the domain-matching rule of RFC 6265 Section 5.1.3, which asks whether the request host is the domain or ends with a dot followed by it. Section 5.3 step 5, which additionally requires rejecting a Domain that is...