CVE-2026-107279— AsyncHttpClient: Digest mutual authentication is switched off by a peer offering qop=auth-int
Quick assessment
Affected
AsyncHttpClient async-http-client
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
AsyncHttpClient（AHC）库允许 Java 应用程序轻松执行 HTTP 请求并异步处理 HTTP 响应。在版本 3.0.12 中，如果对端仅提供 Digest 挑战中的 qop=auth-int，则会导致相互身份验证验证被跳过。由于 AuthenticatorUtils.computeExpectedRspAuth 方法对 auth-int 返回的期望值为空，Interceptors 将该结果视为“不可验证但非致命”，从而接受带有无效 rspauth 值的响应。因此，即使对端不知道共享密钥，也可能被误
Possible ATT&CK Techniques 1 AI
T1078 · Valid Accounts
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-107279
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
AsyncHttpClient: Digest mutual authentication is switched off by a peer offering qop=auth-int
Source: CVE Program / CVE List V5
Vulnerability Description
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. In 3.0.12, a peer offering only Digest qop=auth-int causes mutual-authentication verification to be skipped. AuthenticatorUtils.computeExpectedRspAuth returns no expected value for auth-int, and Interceptors treats that result as unverifiable but nonfatal, so a response with an invalid rspauth value is accepted. A peer that does not know the shared secret can therefore be accepted as the authenticated server. This issue is fixed in version 3.0.13.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
认证算法的不正确实现
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| AsyncHttpClient | async-http-client | = 3.0.12 | - |
|
II. Public POCs for CVE-2026-107279
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-107279
请登录查看更多情报信息。
Other References for CVE-2026-107279 (3)
Same Patch Batch · AsyncHttpClient · 2026-10-07 · 13 CVEs total
| CVE-2026-107282 | 9.4 CRITICAL | AsyncHttpClient: Replay to a different host sends the original host request and credential |
| CVE-2026-107231 | 8.7 HIGH | AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the |
| CVE-2026-107281 | 7.6 HIGH | AsyncHttpClient: Connection pool key omits the authenticated principal, so an NTLM or Nego |
| CVE-2026-107227 | 7.5 HIGH | AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompress |
| CVE-2026-107232 | 7.5 HIGH | AsyncHttpClient: Origin credentials sent in cleartext to a proxy that rejects the CONNECT |
| CVE-2026-107230 | 7.4 HIGH | AsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy l |
| CVE-2026-107280 | 6.9 MEDIUM | AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so |
| CVE-2026-107228 | 6.8 MEDIUM | AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHead |
| CVE-2026-107285 | 5.9 MEDIUM | AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunn |
| CVE-2026-107229 | 4.0 MEDIUM | AsyncHttpClient: Incomplete origin checks in the default cookie store allow cookie tossing |
| CVE-2026-107284 | 3.7 LOW | AsyncHttpClient: WebSocket handshake continues after a failed Sec-WebSocket-Accept check |
| CVE-2026-107283 | 3.7 LOW | AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random so |
IV. Related Vulnerabilities
Same product: async-http-client
-
CVE-2026-107285
AsyncHttpClient: WebSocket proxy credentials sent to the ori -
CVE-2026-107284
AsyncHttpClient: WebSocket handshake continues after a faile -
CVE-2026-107283
AsyncHttpClient: Digest authentication cnonce generated with -
CVE-2026-107282
AsyncHttpClient: Replay to a different host sends the origin -
CVE-2026-107281
AsyncHttpClient: Connection pool key omits the authenticated
Same vendor: AsyncHttpClient
-
CVE-2026-107285
AsyncHttpClient: WebSocket proxy credentials sent to the ori -
CVE-2026-107284
AsyncHttpClient: WebSocket handshake continues after a faile -
CVE-2026-107283
AsyncHttpClient: Digest authentication cnonce generated with -
CVE-2026-107282
AsyncHttpClient: Replay to a different host sends the origin -
CVE-2026-107281
AsyncHttpClient: Connection pool key omits the authenticated
Same weakness: CWE-303
-
CVE-2026-97720
Apache Impala: Impala Executor Webserver Auth Bypass -
CVE-2026-92873
Pgpool-II认证算法缺陷致未授权提升看门狗节点 -
CVE-2026-101878
Bitwarden Server 2025.6.0 < 2025.6.0 Authentication Bypass v -
CVE-2026-93394
libmongoc SCRAM client nonce-validation bypass -
CVE-2026-15688
Password Authentication Bypass Vulnerability in GX Works3 an
V. Comments for CVE-2026-107279
No comments yet