AsyncHttpClient Credentials Leaked in Cleartext via Failed CONNECT (CVE-2026-107232)

Vulnerability Overview Vulnerability Name: Origin credentials sent in cleartext to a proxy that rejects the CONNECT Description: This vulnerability involves a security issue in the asynchronous HTTP client (AsyncHttpClient) when handling proxy connections. When the client attempts to establish a tunnel through a proxy and the proxy rejects the CONNECT request, the client resends the original request, causing credentials to be transmitted to the proxy in cleartext. Affected Versions Affected Versions: - 3.x: 3.0.0 to 3.0.11 - 2.x: 2.0.0 to 2.16.0 Fixed Versions: - 3.0.12 - 2.16.1 Fix Patch: In versions 3.0.12 and 2.16.1, the client now records whether the tunnel was actually established and only processes the connection if the CONNECT succeeds. Responses to CONNECT are no longer dispatched to 401 and redirect handlers but are instead handled as the original request. The 407 status code is still processed, as this represents a legitimate proxy challenge for its own credentials. Additional Information CVSS v3 base metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Confidentiality: High - Integrity: None - Availability: None CVE ID: CVE-2026-107232 Weaknesses: - CWE-319 - CWE-441 - CWE-922 Workarounds Do not send requests containing credentials through untrusted HTTP proxies. Restricting to HTTPS origins does not help, as the leak occurs before the tunnel is established. Detailed Information The method infers the tunnel state from the last built request rather than from the result of the CONNECT, causing to never run and preventing it from distinguishing between completed and failed tunnels.

Goal Reached Thanks to every supporter — we hit 100%!

AsyncHttpClient Credentials Leaked in Cleartext via Failed CONNECT (CVE-2026-107232)

More from this source