Async HTTP Client security vulnerabilities

Async Http Client is an open-source Java-based asynchronous HTTP and WebSocket client library developed by AsyncHttpClient. Versions prior to 3.0.9 and 2.14.5 of Async Http Client had security vulnerabilities. These vulnerabilities stemmed from the redirection process, where authorization headers...

cpython: Excessive read buffering DoS in http.client

A flaw was found in the http.client module in the Python standard library. When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This issue allows a malicious server to cause the client to read large amounts of data into...

Angular: SSRF via protocol-relative and backslash URLs in Angular Platform-Server

Impact A Server-Side Request Forgery SSRF vulnerability exists in @angular/platform-server due to improper handling of URLs during Server-Side Rendering SSR. When an attacker sends a request such as GET /\evil.com/ HTTP/1.1 the server engine Express, etc. passes the URL string to Angular’s...

CLEANSTART-2026-TW25027 Axios is a promise based HTTP client for the browser and Node

Multiple security vulnerabilities affect the mongosh package. Axios is a promise based HTTP client for the browser and Node. See references for individual vulnerability details...

com.akamai.edgegrid:edgegrid-signer-async-http-client (>=6.0.1-rc.1, <=6.0.3), com.arpnetworking.metrics:mad-experimental (>=1.2.3, <=1.2.11) +80 more potentially affected by CVE-2026-40490 via org.asynchttpclient:async-http-client (>=3.0.0.beta1, <=3.0.7)

org.asynchttpclient:async-http-client MAVEN version =3.0.0.beta1, =6.0.1-rc.1, =1.2.3, =1.22.2, =1.13.6, =1.1.0, =0.4.7, =0.4.7, =0.4.7, =1.17.0, =1.17.0, =1.17.0, =0.5.0, =0.0.9, =2.7.3, =2.8.5 and more Source cves: CVE-2026-40490 Source advisory: GHSA-CMXV-58FP-FM3G...

com.akamai.edgegrid:edgegrid-signer-async-http-client (>=6.0.1-rc.1, <=6.0.3), com.arpnetworking.metrics:mad-experimental (>=1.2.3, <=1.2.11) +80 more potentially affected by CVE-2026-40490 via org.asynchttpclient:async-http-client (>=3.0.0.beta1, <=3.0.7)

org.asynchttpclient:async-http-client MAVEN version =3.0.0.beta1, =6.0.1-rc.1, =1.2.3, =1.22.2, =1.13.6, =1.1.0, =0.4.7, =0.4.7, =0.4.7, =1.17.0, =1.17.0, =1.17.0, =0.5.0, =0.0.9, =2.7.3, =2.8.5 and more Source cves: CVE-2026-40490 Source advisory: OSV:GHSA-CMXV-58FP-FM3G...

ai.evolv:ascend-sdk (0.5.0), ai.taskmonk:taskmonk-sdk (>=1.7, <=1.16.6) +2866 more potentially affected by CVE-2026-40490 via org.asynchttpclient:async-http-client (>=2.0.0-alpha13, <=2.12.4)

org.asynchttpclient:async-http-client MAVEN version =2.0.0-alpha13, =1.7, =4.1.0, =4.2.14, =4.1.0, =4.1.0, =4.1.0, =4.2.14, =3.5.5, =3.5.5, =3.5.5, =3.5.7-jre7.0 and more Source cves: CVE-2026-40490 Source advisory: SNYK:JAVA-ORGASYNCHTTPCLIENT-16032254...

ai.evolv:ascend-sdk (0.5.0), ai.taskmonk:taskmonk-sdk (>=1.7, <=1.16.6) +2850 more potentially affected by CVE-2026-40490 via org.asynchttpclient:async-http-client (>=2.0.0, <=2.12.4)

org.asynchttpclient:async-http-client MAVEN version =2.0.0, =1.7, =4.1.0, =4.2.14, =4.1.0, =4.1.0, =4.1.0, =4.2.14, =3.5.5, =3.5.5, =3.5.5, =3.5.7-jre7.0 and more Source cves: CVE-2026-40490 Source advisory: OSV:GHSA-CMXV-58FP-FM3G...

ai.evolv:ascend-sdk (0.5.0), ai.taskmonk:taskmonk-sdk (>=1.7, <=1.16.6) +2850 more potentially affected by CVE-2026-40490 via org.asynchttpclient:async-http-client (>=2.0.0, <=2.12.4)

org.asynchttpclient:async-http-client MAVEN version =2.0.0, =1.7, =4.1.0, =4.2.14, =4.1.0, =4.1.0, =4.1.0, =4.2.14, =3.5.5, =3.5.5, =3.5.5, =3.5.7-jre7.0 and more Source cves: CVE-2026-40490 Source advisory: GHSA-CMXV-58FP-FM3G...

com.akamai.edgegrid:edgegrid-signer-async-http-client (>=6.0.1-rc.1, <=6.0.3), com.arpnetworking.metrics:mad-experimental (>=1.2.3, <=1.2.11) +80 more potentially affected by CVE-2026-40490 via org.asynchttpclient:async-http-client (>=3.0.0.beta1, <=3.0.7)

org.asynchttpclient:async-http-client MAVEN version =3.0.0.beta1, =6.0.1-rc.1, =1.2.3, =1.22.2, =1.13.6, =1.1.0, =0.4.7, =0.4.7, =0.4.7, =1.17.0, =1.17.0, =1.17.0, =0.5.0, =0.0.9, =2.7.3, =2.8.5 and more Source cves: CVE-2026-40490 Source advisory: SNYK:JAVA-ORGASYNCHTTPCLIENT-16032254...

Origin Validation Error

Overview org.asynchttpclient:async-http-client is a maven plugin for the Async Http Client AHC classes. Affected versions of this package are vulnerable to Origin Validation Error in the Redirect30xInterceptor class. An attacker in control of a cross-origin redirect target via a different exploit...

cpython: Excessive read buffering DoS in http.client

A flaw was found in the http.client module in the Python standard library. When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This issue allows a malicious server to cause the client to read large amounts of data into...

cpython: Excessive read buffering DoS in http.client

A flaw was found in the http.client module in the Python standard library. When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This issue allows a malicious server to cause the client to read large amounts of data into...

CVE-2026-1502 HTTP client proxy tunnel headers not validated for CR/LF

CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host...

CVE-2026-1502

CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host...

CVE-2026-1502

The CVE-2026-1502 entry concerns CR/LF bytes not being rejected by HTTP client proxy tunnel headers or host, as described in both the CVE record and the CVE-List entry. The connected documents indicate this is related to HTTP client proxy tunnel header validation, without providing specific affec...

Security Bulletin: Vulnerabilities in urllib3, router, qs, cryptography, axios might affect IBM Storage Defender Sentinel Anomaly Scan Engine.

Summary IBM Storage Defender Sentinel Anomaly Scan Engine can be affected by vulnerabilities in urllib3, router, qs, cryptography, and axios. Vulnerabilities include allowing an attacker to cause cross-site scripting, input improper data, provide a public key point from a small order subgroup, an...

CVE-2026-1502: Improper Neutralization of CRLF Sequences

CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host...

CVE-2026-40089 Sonicverse has Server-Side Request Forgery via user-controlled URLs in dashboard API client

Sonicverse is a Self-hosted Docker Compose stack for live radio streaming. The Sonicverse Radio Audio Streaming Stack dashboard contains a Server-Side Request Forgery SSRF vulnerability in its API client apps/dashboard/lib/api.ts. Installations created using the provided install.sh script includi...

-fides-amor-et-lux (1.0.0), 0xpay-cc-sdk (>=0.0.8, <=0.1.0) +14544 more potentially affected by CVE-2025-62718 via axios (>=1.0.0, <=1.14.0)

axios NPM version =1.0.0, =0.0.8, =1.0.54, =0.1.0, =1.0.1, =1.0.0, =0.0.1, =0.0.1, =0.1.2, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.1.0-beta.18 and more Source cves: CVE-2025-62718 Source advisory: OSV:GHSA-3P68-RC4W-QGX5...