CVE-2026-107285

The AsyncHttpClient (AHC) library, used by Java applications, contains a vulnerability in versions prior to 3.0.12 and 2.16.1 . The root cause lies in how NettyRequestFactory.newNettyRequest and requestUri determine whether to attach proxy authentication; because ws is not marked as secure, tunne...

CVE-2026-107285 AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, a proxied ws request is carried through CONNECT, but NettyRequestFactory.newNettyRequest and requestUri decide whether to attach proxy...

CVE-2026-107285

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, a proxied ws request is carried through CONNECT, but NettyRequestFactory.newNettyRequest and requestUri decide whether to attach proxy...

CVE-2026-107232 AsyncHttpClient: Origin credentials sent in cleartext to a proxy that rejects the CONNECT

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 on 3.x and 2.16.1 on 2.x, the client infers that an HTTP proxy tunnel exists from the last request method rather than the CONNECT result. After a pro...

CVE-2026-107232 AsyncHttpClient: Origin credentials sent in cleartext to a proxy that rejects the CONNECT

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 on 3.x and 2.16.1 on 2.x, the client infers that an HTTP proxy tunnel exists from the last request method rather than the CONNECT result. After a pro...

CVE-2026-107232

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 on 3.x and 2.16.1 on 2.x, the client infers that an HTTP proxy tunnel exists from the last request method rather than the CONNECT result. After a pro...

CVE-2026-107232 AsyncHttpClient: Origin credentials sent in cleartext to a proxy that rejects the CONNECT

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 on 3.x and 2.16.1 on 2.x, the client infers that an HTTP proxy tunnel exists from the last request method rather than the CONNECT result. After a pro...

EUVD-2026-94637

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 on 3.x and 2.16.1 on 2.x, the client infers that an HTTP proxy tunnel exists from the last request method rather than the CONNECT result. After a pro...

CVE-2026-107232

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 on 3.x and 2.16.1 on 2.x, the client infers that an HTTP proxy tunnel exists from the last request method rather than the CONNECT result. After a pro...

CVE-2026-107232

The AsyncHttpClient (AHC) library for Java applications is vulnerable to cleartext credential transmission in versions prior to 3.0.12 (3.x) and 2.16.1 (2.x) . The root cause is that the client incorrectly infers an active HTTP proxy tunnel based on the last request method rather than the CONNECT...

CVE-2026-107230

The AsyncHttpClient (AHC) Java library, from version 2.0.0 until 3.0.14 , contains a vulnerability where connection-pool partitioning fails to omit identity-defining fields for Kerberos, SPNEGO, NTLM , and authenticated proxy connections. This flaw allows logins lacking configured principals, pro...

CVE-2026-107230 AsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy logins

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 3.0.14, connection-pool partitioning still omits identity-defining fields for Kerberos, SPNEGO, NTLM, and authenticated proxy connections. Logins...

com.codacy:metrics-dropwizard_2.11 (>=1.0.33, <=3.1.2), com.codacy:metrics-dropwizard_2.12 (>=1.0.33, <=3.1.2) +428 more potentially affected by CVE-2026-106122 via com.rabbitmq:amqp-client (4.4.1)

com.rabbitmq:amqp-client MAVEN version 4.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.codacy:metrics-dropwizard2.11 =1.0.33, =1.0.33, =3.1.0, =1.30.0, =1.29.0, =1.29.0, =1.2.0, =v0.0.5, =v0.0.5...

EUVD-2026-93989

Backstage: Inconsistent credential enforcement for overlapping proxy routes...

Backstage: Inconsistent credential enforcement for overlapping proxy routes

Impact An operator can configure overlapping proxy paths with different credential requirements. When a parent path permits unauthenticated access and a nested path requires credentials, the parent exemption can also cover requests handled by the nested proxy. An unauthenticated caller may...

GHSA-472H-9C5J-PRRR Backstage: Inconsistent credential enforcement for overlapping proxy routes

Impact An operator can configure overlapping proxy paths with different credential requirements. When a parent path permits unauthenticated access and a nested path requires credentials, the parent exemption can also cover requests handled by the nested proxy. An unauthenticated caller may...

CVE-2026-97717

CVE-2026-97717 is a vulnerability in the proxy sub-system of Secure Access servers prior to 14.60. Authenticated attackers can send malformed data to the server and cause a persistent denial of service...

EUVD-2026-94576

CVE-2026-97717 is a vulnerability in the proxy sub-system of Secure Access servers prior to 14.60. Authenticated attackers can send malformed data to the server and cause a persistent denial of service...

CVE-2026-97717

CVE-2026-97717 is a vulnerability in the proxy sub-system of Absolute Secure Access servers running versions prior to 14.60 . An authenticated attacker can exploit this flaw by sending malformed data to the server, resulting in a persistent denial of service . No specific exploit information or r...

CVE-2026-97717 Denial of Service in Absolute Secure Access

CVE-2026-97717 is a vulnerability in the proxy sub-system of Secure Access servers prior to 14.60. Authenticated attackers can send malformed data to the server and cause a persistent denial of service...