Linux Distros Unpatched Vulnerability : CVE-2026-85716

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 3.0.8 until 3.0.12,...

GHSA-FJ9W-C36G-H5X8 AsyncHttpClient doesn't verify SCRAM and Digest mutual-authentication responses

Impact For SCRAM, and for Digest with mutual authentication, the client computes the server's verification value the SCRAM ServerSignature, or the Digest rspauth but does not act on the result. If the value is present and does not verify, the client only logs it and still delivers the response to...

AsyncHttpClient doesn't verify SCRAM and Digest mutual-authentication responses

Impact For SCRAM, and for Digest with mutual authentication, the client computes the server's verification value the SCRAM ServerSignature, or the Digest rspauth but does not act on the result. If the value is present and does not verify, the client only logs it and still delivers the response to...

CVE-2026-85716

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 3.0.8 until 3.0.12, processScramAuthenticationInfo and processAuthenticationInfo compute the SCRAM ServerSignature or Digest rspauth verification result but log...

CVE-2026-85716: Improper Authentication

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 3.0.8 until 3.0.12, processScramAuthenticationInfo and processAuthenticationInfo compute the SCRAM ServerSignature or Digest rspauth verification result but log...

curl: 12: SASL DIGEST-MD5 does not validate the server's `rspauth` proof

Summary curl never verifies the rspauth value the server sends during SASL DIGEST-MD5 authentication. In Curlsaslcontinue lib/curlsasl.c, the SASLDIGESTMD5RESP handler unconditionally sends an empty acknowledgment without reading or checking the server's continuation data. Authentication then...