CVE-2026-85718

AsyncHttpClient (AHC) for Java is affected by a connection permit leak in versions 3.0.8 through 3.0.12. When a TLS connection fails before the handshake completes, NettyConnectListener removes the partition key lock permit from NettyResponseFuture before all failure paths are bound to the channe...

EUVD-2026-81908

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 3.0.8 until 3.0.12, a client with maxConnections or maxConnectionsPerHost set above zero leaks one connection permit whenever TLS connection establishment fails...

CVE-2026-85718 AsyncHttpClient: Connection permit leak on TLS handshake failure causes per-host denial of service

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 3.0.8 until 3.0.12, a client with maxConnections or maxConnectionsPerHost set above zero leaks one connection permit whenever TLS connection establishment fails...

CVE-2026-85721 AsyncHttpClient: Unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of service

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 and 3.0.12, automatic response decompression on the HTTP/1.1 path uses ChannelManager.newHttpContentDecompressor to install...

CVE-2026-85721

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 and 3.0.12, automatic response decompression on the HTTP/1.1 path uses ChannelManager.newHttpContentDecompressor to install...

EUVD-2026-81907

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 and 3.0.12, automatic response decompression on the HTTP/1.1 path uses ChannelManager.newHttpContentDecompressor to install...

CVE-2026-85721 AsyncHttpClient: Unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of service

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 and 3.0.12, automatic response decompression on the HTTP/1.1 path uses ChannelManager.newHttpContentDecompressor to install...

CVE-2026-85721

CVE-2026-85721 affects the AsyncHttpClient (AHC) Java library. The automatic response decompressor on the HTTP/1.1 path (Http1ContentDecompressor) had no cumulative output-size limit, allowing a hostile or compromised server to send a small compressed response that expands across chunks until the...

CVE-2026-85717 AsyncHttpClient: Client-wide realm credentials re-sent to a cross-origin redirect target

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.14.5 to 2.16.0 and from 3.0.9 to 3.0.11, a client configured with a client-wide Realm and redirect following can disclose credentials after a cross-origin...

CVE-2026-85717

CVE-2026-85717 affects the AsyncHttpClient (AHC) Java library, versions 2.14.5–2.16.0 and 3.0.9–3.0.11 . When a client is configured with a client-wide Realm and redirect following , the Interceptors authentication path falls back to the client configuration after redirect handling clears the per...

EUVD-2026-81905

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.14.5 to 2.16.0 and from 3.0.9 to 3.0.11, a client configured with a client-wide Realm and redirect following can disclose credentials after a cross-origin...

CVE-2026-85717

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.14.5 to 2.16.0 and from 3.0.9 to 3.0.11, a client configured with a client-wide Realm and redirect following can disclose credentials after a cross-origin...

CVE-2026-85719 AsyncHttpClient: SOCKS proxy credentials sent to the origin server over plaintext HTTP

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 2.16.1 and 3.0.12, requests using an authenticated SOCKS proxy can expose the proxy's credentials to the origin because NettyRequestFactory and...

CVE-2026-85719

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 2.16.1 and 3.0.12, requests using an authenticated SOCKS proxy can expose the proxy's credentials to the origin because NettyRequestFactory and...

ch.vorburger.mariadb4j:mariadb4j-app (3.2.0), cn.zpcnet.beanforge:beanforge-cli (0.2.0) +184 more potentially affected by CVE-2026-61700 via org.mariadb.jdbc:mariadb-java-client (>=3.4.0, <=3.4.2)

org.mariadb.jdbc:mariadb-java-client MAVEN version =3.4.0, =1.0.2, =1.1.0, =1.0.5, =1.1.0, =1.1.0, =1.1.0, =0.2.0, =1.1.0, =7.0.0, =7.0.0, =9.1.1 and more Source cves: CVE-2026-61700 Source advisory: MEND:CVE-2026-61700...

ai.starlake:starlake-api_2.13 (>=1.5.8, <=1.5.15), at.meks.quarkiverse.axonframework-extension:quarkus-axonframework-extension-integration-tests (0.1.0-rc14) +400 more potentially affected by CVE-2026-61700 via org.mariadb.jdbc:mariadb-java-client (>=3.5.0, <=3.5.8)

org.mariadb.jdbc:mariadb-java-client MAVEN version =3.5.0, =1.5.8, =0.1.0-rc15, =3.3.0, =1.0.3, =1.0.0, =1.21.1, =1.7.1, =1.7.1, =2.2.5, =2.2.5, =2.2.5, =2.0.0-rc4, =2.0.0-rc4, =2.0.0 and more Source cves: CVE-2026-61700 Source advisory: MEND:CVE-2026-61700...

at.chrl:chrl-orm-spring-integration (1.1.0), bayern.steinbrecher:dbconnector (>=0.10, <=0.15) +635 more potentially affected by CVE-2026-61700 via org.mariadb.jdbc:mariadb-java-client (>=1.1.7, <=2.7.13)

org.mariadb.jdbc:mariadb-java-client MAVEN version =1.1.7, =0.10, =3.5.0, =5.6.5, =1.3.1-beta-2, =1.3.1-beta-2, =1.0.0, =1.0.0, =2.4.0, =0.3.5, =1.1.0, =1.1.0, =1.0.2, =1.0.0, =1.0.5 and more Source cves: CVE-2026-61700 Source advisory: MEND:CVE-2026-61700...

ba.sake:mill-squery-generator_mill0.11_2.13 (>=0.4.0, <=0.7.0), ba.sake:mill-squery-generator_mill1_3 (>=0.8.0, <=0.11.0) +656 more potentially affected by CVE-2026-61700 via org.mariadb.jdbc:mariadb-java-client (>=3.0.3, <=3.3.4)

org.mariadb.jdbc:mariadb-java-client MAVEN version =3.0.3, =0.4.0, =0.8.0, =6.0.0, =6.0.3, =2.6.0, =2.0.0, =0.4.2, =0.0.1, =1.0.0, =1.6.2, =1.6.2, =2.2.0, =3.2.0 and more Source cves: CVE-2026-61700 Source advisory: MEND:CVE-2026-61700...

com.squareup.wire:wire-compiler (3.6.1), com.squareup.wire:wire-gradle-plugin (3.6.1) +12 more potentially affected by CVE-2026-45799 +1 more via com.squareup.wire:wire-runtime (3.6.1)

com.squareup.wire:wire-runtime MAVEN version 3.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-compiler 3.6.1 - com.squareup.wire:wire-gradle-plugin 3.6.1 -...

com.squareup.wire:wire-compiler (2.0.0-beta9), com.squareup.wire:wire-gson-support (2.0.0-beta9) +4 more potentially affected by CVE-2026-45799 +1 more via com.squareup.wire:wire-runtime (2.0.0-beta9)

com.squareup.wire:wire-runtime MAVEN version 2.0.0-beta9 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-compiler 2.0.0-beta9 - com.squareup.wire:wire-gson-support 2.0.0-beta9...