CVE-2026-85721

A flaw was found in AsyncHttpClient's automatic HTTP response decompression. With automatic decompression enabled the default, the HTTP/1.1 path does not limit the total decompressed response size. A hostile or compromised server, or an attacker able to change a response in transit, can send a...