Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

AsyncHttpClient — Vulnerabilities & Security Advisories 24

Browse all 24 CVE security advisories affecting AsyncHttpClient. AI-powered Chinese analysis, POCs, and references for each vulnerability.

This page aggregates vulnerability data for the vendor AsyncHttpClient, focusing specifically on the software product category and related weakness types. It collects historical security advisories and vulnerability records for AsyncHttpClient, covering the complete timeframe from the product's first public release through the most recent disclosed issues. Readers can use this page to track the vendor's published advisories, understand the recurring weakness classes affecting this product, and review the full vulnerability history to identify common failure patterns over time. The aggregation provides a centralized view of security flaws, enabling detailed analysis of how specific weaknesses have emerged, evolved, and impacted the AsyncHttpClient codebase. This resource supports security teams in assessing risk exposure and understanding the long-term security posture of the product without navigating multiple separate databases.

Top products by AsyncHttpClient: async-http-client
CVE ID Title CVSS Severity Published
CVE-2026-107226 AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPS — async-http-client CWE-384 6.8 Medium 2026-10-12
CVE-2026-107285 AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel — async-http-client CWE-319 5.9 Medium 2026-10-07
CVE-2026-107284 AsyncHttpClient: WebSocket handshake continues after a failed Sec-WebSocket-Accept check — async-http-client CWE-345 3.7 Low 2026-10-07
CVE-2026-107283 AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random source — async-http-client CWE-338 3.7 Low 2026-10-07
CVE-2026-107282 AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host — async-http-client CWE-319 9.4 Critical 2026-10-07
CVE-2026-107281 AsyncHttpClient: Connection pool key omits the authenticated principal, so an NTLM or Negotiate connection is reused across identities — async-http-client CWE-346 7.6 High 2026-10-07
CVE-2026-107280 AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.uk — async-http-client CWE-1275 6.9 Medium 2026-10-07
CVE-2026-107279 AsyncHttpClient: Digest mutual authentication is switched off by a peer offering qop=auth-int — async-http-client CWE-303 8.8 High 2026-10-07
CVE-2026-107232 AsyncHttpClient: Origin credentials sent in cleartext to a proxy that rejects the CONNECT — async-http-client CWE-319 7.5 High 2026-10-07
CVE-2026-107231 AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext — async-http-client CWE-319 8.7 High 2026-10-07
CVE-2026-107230 AsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy logins — async-http-client CWE-346 7.4 High 2026-10-07
CVE-2026-107229 AsyncHttpClient: Incomplete origin checks in the default cookie store allow cookie tossing onto public-suffix and IP-address hosts — async-http-client CWE-384 4.0 Medium 2026-10-07
CVE-2026-107228 AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader (Bypass of CVE-2024-53990 Fix) — async-http-client CWE-287 6.8 Medium 2026-10-07
CVE-2026-107227 AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabled — async-http-client CWE-400 7.5 High 2026-10-07
CVE-2026-85716 AsyncHttpClient: SCRAM and Digest mutual-authentication responses are not verified — async-http-client CWE-287 3.7 Low 2026-09-17
CVE-2026-85720 AsyncHttpClient: Origin credentials sent to the proxy on the plaintext CONNECT request — async-http-client CWE-319 5.9 Medium 2026-09-17
CVE-2026-85718 AsyncHttpClient: Connection permit leak on TLS handshake failure causes per-host denial of service — async-http-client CWE-400 5.9 Medium 2026-09-17
CVE-2026-85721 AsyncHttpClient: Unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of service — async-http-client CWE-400 7.5 High 2026-09-17
CVE-2026-85717 AsyncHttpClient: Client-wide realm credentials re-sent to a cross-origin redirect target — async-http-client CWE-200 6.8 Medium 2026-09-17
CVE-2026-85719 AsyncHttpClient: SOCKS proxy credentials sent to the origin server over plaintext HTTP — async-http-client CWE-319 7.5 High 2026-09-17
CVE-2026-55688 AsyncHttpClient: Cookie stored for an unrelated domain (cookie tossing) via ThreadSafeCookieStore — async-http-client CWE-1275 4.0 Medium 2026-07-01
CVE-2026-45300 async-http-client: Cookie header not stripped on cross-origin redirect — async-http-client CWE-200 7.4 High 2026-06-05
CVE-2026-40490 AsyncHttpClient leaks authorization credentials to untrusted domains on cross-origin redirects — async-http-client CWE-200 6.8 Medium 2026-04-18
CVE-2024-53990 AsyncHttpClient (AHC) library's `CookieStore` replaces explicitly defined `Cookie`s — async-http-client CWE-287 8.2 - 2024-12-02

This page lists every published CVE security advisory associated with AsyncHttpClient. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.