Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

async-http-client — Vulnerabilities & Security Advisories 24

All 24 CVE vulnerabilities found in async-http-client, with AI-generated Chinese analysis, references, and POCs.

This page details Common Weakness Enumerations affecting the async-http-client library, a widely used asynchronous HTTP client for Java applications. It aggregates security flaws identified in this specific software component, focusing on vulnerabilities that may impact application stability, data confidentiality, or system integrity. The content covers incidents reported over the last five years, providing a comprehensive view of the project's security posture as it evolved through various releases. Readers can track vendor advisories to stay informed about when patches were released and which versions are affected. This resource allows security professionals and developers to understand the nature of specific weakness classes within the context of this library, revealing patterns in how flaws were introduced or mitigated. Additionally, users can look up the product’s vulnerability history to assess risk levels based on past incidents and remediation efforts. By consolidating these data points, the page serves as a central reference for evaluating the security maturity of async-http-client. It helps teams make informed decisions about upgrades and dependency management by highlighting known issues and their resolutions. This structured approach facilitates better risk assessment and ensures that developers have access to accurate, timely information regarding potential threats associated with this open-source tool.

Vendor: AsyncHttpClient

CVE ID Title CVSS Severity Published
CVE-2026-107226 AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPS CWE-384 6.8 Medium 2026-10-12
CVE-2026-107285 AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel CWE-319 5.9 Medium 2026-10-07
CVE-2026-107284 AsyncHttpClient: WebSocket handshake continues after a failed Sec-WebSocket-Accept check CWE-345 3.7 Low 2026-10-07
CVE-2026-107283 AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random source CWE-338 3.7 Low 2026-10-07
CVE-2026-107282 AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host CWE-319 9.4 Critical 2026-10-07
CVE-2026-107281 AsyncHttpClient: Connection pool key omits the authenticated principal, so an NTLM or Negotiate connection is reused across identities CWE-346 7.6 High 2026-10-07
CVE-2026-107280 AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.uk CWE-1275 6.9 Medium 2026-10-07
CVE-2026-107279 AsyncHttpClient: Digest mutual authentication is switched off by a peer offering qop=auth-int CWE-303 8.8 High 2026-10-07
CVE-2026-107232 AsyncHttpClient: Origin credentials sent in cleartext to a proxy that rejects the CONNECT CWE-319 7.5 High 2026-10-07
CVE-2026-107231 AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext CWE-319 8.7 High 2026-10-07
CVE-2026-107230 AsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy logins CWE-346 7.4 High 2026-10-07
CVE-2026-107229 AsyncHttpClient: Incomplete origin checks in the default cookie store allow cookie tossing onto public-suffix and IP-address hosts CWE-384 4.0 Medium 2026-10-07
CVE-2026-107228 AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader (Bypass of CVE-2024-53990 Fix) CWE-287 6.8 Medium 2026-10-07
CVE-2026-107227 AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabled CWE-400 7.5 High 2026-10-07
CVE-2026-85716 AsyncHttpClient: SCRAM and Digest mutual-authentication responses are not verified CWE-287 3.7 Low 2026-09-17
CVE-2026-85720 AsyncHttpClient: Origin credentials sent to the proxy on the plaintext CONNECT request CWE-319 5.9 Medium 2026-09-17
CVE-2026-85718 AsyncHttpClient: Connection permit leak on TLS handshake failure causes per-host denial of service CWE-400 5.9 Medium 2026-09-17
CVE-2026-85721 AsyncHttpClient: Unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of service CWE-400 7.5 High 2026-09-17
CVE-2026-85717 AsyncHttpClient: Client-wide realm credentials re-sent to a cross-origin redirect target CWE-200 6.8 Medium 2026-09-17
CVE-2026-85719 AsyncHttpClient: SOCKS proxy credentials sent to the origin server over plaintext HTTP CWE-319 7.5 High 2026-09-17
CVE-2026-55688 AsyncHttpClient: Cookie stored for an unrelated domain (cookie tossing) via ThreadSafeCookieStore CWE-1275 4.0 Medium 2026-07-01
CVE-2026-45300 async-http-client: Cookie header not stripped on cross-origin redirect CWE-200 7.4 High 2026-06-05
CVE-2026-40490 AsyncHttpClient leaks authorization credentials to untrusted domains on cross-origin redirects CWE-200 6.8 Medium 2026-04-18
CVE-2024-53990 AsyncHttpClient (AHC) library's `CookieStore` replaces explicitly defined `Cookie`s CWE-287 8.2 - 2024-12-02

All 24 known CVE vulnerabilities affecting async-http-client with full Chinese analysis, references, and POCs where available.