Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-85716— AsyncHttpClient: SCRAM and Digest mutual-authentication responses are not verified

Quick assessment

Affected
AsyncHttpClient async-http-client
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

AsyncHttpClient（AHC）库允许 Java 应用程序轻松执行 HTTP 请求并异步处理 HTTP 响应。在 3.0.8 到 3.0.12 版本中， 和 方法会计算 SCRAM ServerSignature 或 Digest 的 校验结果，但在检测到不匹配时仅记录日志，仍然将响应作为已认证处理。因此，在非 TLS 传输或传输层被篡改的情况下，未证明掌握共享密钥的对等方可能被错误地接受为服务器。 修复方案会拒绝存在的无效值，并根据实际发送的 Authorization 参数重新计算 Digest 的 ；

CVSS 3.7 · Low
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-85716

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
AsyncHttpClient: SCRAM and Digest mutual-authentication responses are not verified
Source: CVE Program / CVE List V5
Vulnerability Description
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 3.0.8 until 3.0.12, processScramAuthenticationInfo and processAuthenticationInfo compute the SCRAM ServerSignature or Digest rspauth verification result but log a mismatch and still deliver the response as authenticated. On a non-TLS or compromised transport, a peer that has not proved knowledge of the shared secret can therefore be accepted as the server. The fix rejects a present invalid value and computes Digest rspauth from the Authorization parameters actually sent, but verification remains unenforced when the value is absent, the sent parameters cannot be recovered, or Digest uses qop=auth-int. This issue is fixed in version 3.0.12.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
认证机制不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
AsyncHttpClient async-http-client >= 3.0.8, < 3.0.12 -

II. Public POCs for CVE-2026-85716

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-85716

请登录查看更多情报信息。

Other References for CVE-2026-85716 (5)

Same Patch Batch · AsyncHttpClient · 2026-09-17 · 6 CVEs total

CVE-2026-85719 7.5 HIGH AsyncHttpClient: SOCKS proxy credentials sent to the origin server over plaintext HTTP
CVE-2026-85721 7.5 HIGH AsyncHttpClient: Unbounded HTTP/1.1 response decompression enables a decompression-bomb de
CVE-2026-85717 6.8 MEDIUM AsyncHttpClient: Client-wide realm credentials re-sent to a cross-origin redirect target
CVE-2026-85718 5.9 MEDIUM AsyncHttpClient: Connection permit leak on TLS handshake failure causes per-host denial of
CVE-2026-85720 5.9 MEDIUM AsyncHttpClient: Origin credentials sent to the proxy on the plaintext CONNECT request

IV. Related Vulnerabilities

Same product: async-http-client
Same vendor: AsyncHttpClient
Same weakness: CWE-287

V. Comments for CVE-2026-85716

No comments yet

Leave a comment