AsyncHttpClient CVE-2026-107285 WebSocket Proxy Credential Leakage via CONNECT Tunnel

WebSocket Proxy Credentials Sent to Origin Server via CONNECT Tunnel Vulnerability Overview When WebSocket requests are routed through an HTTP proxy configured with proxy authentication, the client establishes a tunnel using HTTP CONNECT. Once the tunnel is established, the WebSocket upgrade request (similar to HTTPS) is sent through the tunnel. The proxy gateway and upgrade request target selection are determined solely by whether the URI is secure, which is false for . Consequently, the tunnel upgrade request incorrectly carries the proxy's header and an absolute-form request target. Any attacker positioned at the proxy or origin server can recover proxy credentials via direct Basic authentication or by replaying and offline-cracking Digest responses. Affected Versions Affected Versions: - 3.x: 3.0.0 to 3.0.11 - 2.x: 2.0.0 to 2.16.0 Remediation Fixed Versions: - 3.x: 3.0.12 - 2.x: 2.16.1 Patch Notes: - In the 3.x branch at 3.0.12 and the 2.x branch at 2.16.1, preemptive headers and absolute-form request targets are no longer appended to tunneled upgrades. requests are now treated as . Workaround: - Do not use proxy authentication with requests. Instead of using via an HTTP proxy, use . Details CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Confidentiality: High - Integrity: None - Availability: None CVSS Score: 5.9 / 10 CVE ID: CVE-2026-107285 Weaknesses: - CWE-319 - CWE-522 Notes Version 3.0.12 itself is affected by another separate issue GHSA-3wp9-xfwm-rjlf, where Digest challenges fail and degrade to Basic authentication, sending plaintext passwords. Upgrade to 3.0.13 to fix both issues simultaneously.

Goal Reached Thanks to every supporter — we hit 100%!

AsyncHttpClient CVE-2026-107285 WebSocket Proxy Credential Leakage via CONNECT Tunnel

More from this source