CVE-2026-107279

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. In 3.0.12, a peer offering only Digest qop=auth-int causes mutual-authentication verification to be skipped. AuthenticatorUtils.computeExpectedRspAuth returns no...

CVE-2026-107283

Removed by vendor...

CVE-2026-107283 AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random source

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, Realm.Builder generates the HTTP Digest client nonce with ThreadLocalRandom rather than a cryptographically secure random source. Digest...

CVE-2026-107283 AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random source

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, Realm.Builder generates the HTTP Digest client nonce with ThreadLocalRandom rather than a cryptographically secure random source. Digest...

CVE-2026-107283

The AsyncHttpClient (AHC) library for Java applications is vulnerable to reduced authentication security due to the use of a non-cryptographic random source. In versions prior to 3.0.12 and 2.16.1 , the Realm.Builder component generates the HTTP Digest client nonce using ThreadLocalRandom instead...

CVE-2026-107283 AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random source

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, Realm.Builder generates the HTTP Digest client nonce with ThreadLocalRandom rather than a cryptographically secure random source. Digest...

CVE-2026-107279

The AsyncHttpClient (AHC) library, used by Java applications for asynchronous HTTP requests, is vulnerable in version 3.0.12 . The root cause is that a peer offering only Digest qop=auth-int causes mutual-authentication verification to be skipped. Specifically, AuthenticatorUtils.computeExpectedR...

CVE-2026-107279 AsyncHttpClient: Digest mutual authentication is switched off by a peer offering qop=auth-int

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. In 3.0.12, a peer offering only Digest qop=auth-int causes mutual-authentication verification to be skipped. AuthenticatorUtils.computeExpectedRspAuth returns no...

EUVD-2026-94638

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. In 3.0.12, a peer offering only Digest qop=auth-int causes mutual-authentication verification to be skipped. AuthenticatorUtils.computeExpectedRspAuth returns no...

CVE-2026-107279

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. In 3.0.12, a peer offering only Digest qop=auth-int causes mutual-authentication verification to be skipped. AuthenticatorUtils.computeExpectedRspAuth returns no...

CVE-2026-107279 AsyncHttpClient: Digest mutual authentication is switched off by a peer offering qop=auth-int

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. In 3.0.12, a peer offering only Digest qop=auth-int causes mutual-authentication verification to be skipped. AuthenticatorUtils.computeExpectedRspAuth returns no...

CVE-2026-107279 AsyncHttpClient: Digest mutual authentication is switched off by a peer offering qop=auth-int

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. In 3.0.12, a peer offering only Digest qop=auth-int causes mutual-authentication verification to be skipped. AuthenticatorUtils.computeExpectedRspAuth returns no...

CVE-2026-107231

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, Realm.Builder treats a Digest challenge that yields no usable nonce as a Basic challenge. A malicious origin or proxy can label a challen...

CVE-2026-107231

Removed by vendor...

CVE-2026-107231 AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, Realm.Builder treats a Digest challenge that yields no usable nonce as a Basic challenge. A malicious origin or proxy can label a challen...

CVE-2026-107231 AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, Realm.Builder treats a Digest challenge that yields no usable nonce as a Basic challenge. A malicious origin or proxy can label a challen...

CVE-2026-107231

The AsyncHttpClient (AHC) library for Java applications is vulnerable to an authentication downgrade attack in versions prior to 3.0.13 and 2.16.1 . The Realm.Builder component incorrectly treats a Digest challenge that lacks a usable nonce as a Basic challenge . An attacker controlling a proxy o...

CVE-2026-107161

A heap-based buffer overflow flaw was found in Cyrus SASL. The addtochallenge function in the DIGEST-MD5 plugin computes the size of the buffer needed for a challenge/response field before DIGEST-MD5 quoting is applied, but does not recompute that size when quoting escaping special characters mak...

EUVD-2026-94582

A heap-based buffer overflow flaw was found in Cyrus SASL. The addtochallenge function in the DIGEST-MD5 plugin computes the size of the buffer needed for a challenge/response field before DIGEST-MD5 quoting is applied, but does not recompute that size when quoting escaping special characters mak...

CVE-2026-107161 Cyrus-sasl: heap buffer overflow in cyrus-sasl add_to_challenge() allows malicious server to crash or compromise digest-md5 clients

A heap-based buffer overflow flaw was found in Cyrus SASL. The addtochallenge function in the DIGEST-MD5 plugin computes the size of the buffer needed for a challenge/response field before DIGEST-MD5 quoting is applied, but does not recompute that size when quoting escaping special characters mak...