CVE-2026-108266

The Privasys rustls library, a fork of rustls providing RA-TLS challenge and channel-binding support, is vulnerable in versions prior to privasys-v0.8.1 . The root cause is that RA-TLS challenge certificates emitted by the library bound quote ReportData to the certificate public key and client no...

CVE-2026-108266 Privasys rustls fork: RA-TLS challenge mode did not bind attestation evidence to the TLS session

Privasys rustls is a maintained fork of the rustls TLS library that adds RA-TLS challenge and channel-binding support. Prior to privasys-v0.8.1, the fork emitted RA-TLS challenge certificates whose quote ReportData was bound to the certificate public key and client nonce but not to the active TLS...

EUVD-2026-95997

Privasys rustls is a maintained fork of the rustls TLS library that adds RA-TLS challenge and channel-binding support. Prior to privasys-v0.8.1, the fork emitted RA-TLS challenge certificates whose quote ReportData was bound to the certificate public key and client nonce but not to the active TLS...

flareon2023

Flare-On 10 solutions Source codes of my solutions for the tasks from Flare-On10 challenge...

PT-2026-109324

Name of the Vulnerable Software and Affected Versions Privasys rustls versions prior to 0.8.1 Description Privasys rustls, a fork of the rustls TLS library providing RA-TLS challenge and channel-binding support, contains a flaw where RA-TLS challenge certificates are emitted with ReportData bound...

EUVD-2026-94636

AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext...

GHSA-RQF5-2WXV-RJF4 AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext

Impact A Digest challenge that does not yield a usable nonce is treated as a Basic challenge. The client then answers it with Authorization: Basic, which carries the username and password base64 encoded and so recoverable by anyone who sees the request. Any of these is enough, sent by whoever...

AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext

Impact A Digest challenge that does not yield a usable nonce is treated as a Basic challenge. The client then answers it with Authorization: Basic, which carries the username and password base64 encoded and so recoverable by anyone who sees the request. Any of these is enough, sent by whoever...

Linux Distros Unpatched Vulnerability : CVE-2026-107231

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1,...

DEBIAN-CVE-2026-107231

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, Realm.Builder treats a Digest challenge that yields no usable nonce as a Basic challenge. A malicious origin or proxy can label a challen...

CVE-2026-107231

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, Realm.Builder treats a Digest challenge that yields no usable nonce as a Basic challenge. A malicious origin or proxy can label a challen...

CVE-2026-107231

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, Realm.Builder treats a Digest challenge that yields no usable nonce as a Basic challenge. A malicious origin or proxy can label a challen...

Cleartext Transmission of Sensitive Information

Overview org.asynchttpclient:async-http-client is a maven plugin for the Async Http Client AHC classes. Affected versions of this package are vulnerable to Cleartext Transmission of Sensitive Information in the Realm.Builder process when a Digest challenge is received without a usable nonce,...

CVE-2026-107231

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, Realm.Builder treats a Digest challenge that yields no usable nonce as a Basic challenge. A malicious origin or proxy can label a challen...

CVE-2026-107231

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, Realm.Builder treats a Digest challenge that yields no usable nonce as a Basic challenge. A malicious origin or proxy can label a challen...

CVE-2026-107231

The AsyncHttpClient (AHC) library for Java applications is vulnerable to an authentication downgrade attack in versions prior to 3.0.13 and 2.16.1 . The Realm.Builder component incorrectly treats a Digest challenge that lacks a usable nonce as a Basic challenge . An attacker controlling a proxy o...

CVE-2026-107231 AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, Realm.Builder treats a Digest challenge that yields no usable nonce as a Basic challenge. A malicious origin or proxy can label a challen...

CVE-2026-107231 AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, Realm.Builder treats a Digest challenge that yields no usable nonce as a Basic challenge. A malicious origin or proxy can label a challen...

CVE-2026-107231 AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, Realm.Builder treats a Digest challenge that yields no usable nonce as a Basic challenge. A malicious origin or proxy can label a challen...

PT-2026-107681

Name of the Vulnerable Software and Affected Versions AsyncHttpClient versions prior to 3.0.13 AsyncHttpClient versions prior to 2.16.1 Description The AsyncHttpClient library, used by Java applications for asynchronous HTTP requests and responses, contains an issue where Realm.Builder incorrectl...