CVE-2026-107284— AsyncHttpClient: WebSocket handshake continues after a failed Sec-WebSocket-Accept check
Quick assessment
Affected
AsyncHttpClient async-http-client
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
AsyncHttpClient（AHC）库允许 Java 应用程序轻松执行 HTTP 请求并异步处理 HTTP 响应。在版本 3.0.12 和 2.16.1 之前，当 WebSocket 连接的 Sec-WebSocket-Accept 头字段缺失或无效时，WebSocketHandler.upgrade 方法虽然会中止握手过程，但仍会继续执行管道安装（pipeline installation）和 onOpen 回调。由于存在这一缺陷，来自未能有效证明握手完成的对等方的帧（frames）可能被错误地解码并交付给应
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-107284
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
AsyncHttpClient: WebSocket handshake continues after a failed Sec-WebSocket-Accept check
Source: CVE Program / CVE List V5
Vulnerability Description
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, WebSocketHandler.upgrade aborts a handshake whose Sec-WebSocket-Accept value is missing or invalid but continues into pipeline installation and onOpen delivery. Frames coalesced with the invalid 101 response can be decoded and delivered from a peer that did not prove the handshake, although the request future fails and the channel closes. This issue is fixed in versions 3.0.12 and 2.16.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对数据真实性的验证不充分
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| AsyncHttpClient | async-http-client | >= 3.0.0, < 3.0.12 | - |
|
II. Public POCs for CVE-2026-107284
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-107284
请登录查看更多情报信息。
Other References for CVE-2026-107284 (5)
Same Patch Batch · AsyncHttpClient · 2026-10-07 · 13 CVEs total
| CVE-2026-107282 | 9.4 CRITICAL | AsyncHttpClient: Replay to a different host sends the original host request and credential |
| CVE-2026-107279 | 8.8 HIGH | AsyncHttpClient: Digest mutual authentication is switched off by a peer offering qop=auth- |
| CVE-2026-107231 | 8.7 HIGH | AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the |
| CVE-2026-107281 | 7.6 HIGH | AsyncHttpClient: Connection pool key omits the authenticated principal, so an NTLM or Nego |
| CVE-2026-107227 | 7.5 HIGH | AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompress |
| CVE-2026-107232 | 7.5 HIGH | AsyncHttpClient: Origin credentials sent in cleartext to a proxy that rejects the CONNECT |
| CVE-2026-107230 | 7.4 HIGH | AsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy l |
| CVE-2026-107280 | 6.9 MEDIUM | AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so |
| CVE-2026-107228 | 6.8 MEDIUM | AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHead |
| CVE-2026-107285 | 5.9 MEDIUM | AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunn |
| CVE-2026-107229 | 4.0 MEDIUM | AsyncHttpClient: Incomplete origin checks in the default cookie store allow cookie tossing |
| CVE-2026-107283 | 3.7 LOW | AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random so |
IV. Related Vulnerabilities
Same product: async-http-client
-
CVE-2026-107285
AsyncHttpClient: WebSocket proxy credentials sent to the ori -
CVE-2026-107283
AsyncHttpClient: Digest authentication cnonce generated with -
CVE-2026-107282
AsyncHttpClient: Replay to a different host sends the origin -
CVE-2026-107281
AsyncHttpClient: Connection pool key omits the authenticated -
CVE-2026-107280
AsyncHttpClient: Cookie Domain attribute is not checked agai
Same vendor: AsyncHttpClient
-
CVE-2026-107285
AsyncHttpClient: WebSocket proxy credentials sent to the ori -
CVE-2026-107283
AsyncHttpClient: Digest authentication cnonce generated with -
CVE-2026-107282
AsyncHttpClient: Replay to a different host sends the origin -
CVE-2026-107281
AsyncHttpClient: Connection pool key omits the authenticated -
CVE-2026-107280
AsyncHttpClient: Cookie Domain attribute is not checked agai
Same weakness: CWE-345
-
CVE-2026-105818
Vault PKI ACME Issues Certificate With Unvalidated SANs -
CVE-2026-107102
Account Takeover Vulnerability in Manacle Technologies ERP S -
CVE-2026-16516
wolfSSH ECDSA host key curve not validated against negotiate -
CVE-2026-104850
MCP TypeScript SDK: OAuth client could send credentials to a -
CVE-2026-59357
Self-UAA OIDC Configuration allows JWT injection to establis
V. Comments for CVE-2026-107284
No comments yet