CVE Intelligence
Analysis AI-assisted

CVE-2026-107282: AsyncHttpClient: Cross-Host Request Replay Leaks Credentials and Traffic

AsyncHttpClient (AHC) versions before 3.0.13 and 2.16.1 can replay a request to a different host while the target request and proxy context still point to the original origin. Per the record, this can send the original host's path, Host header, Authorization credentials, or plaintext requests to the replay destination. The GitHub CNA scores the issue 9.4 under CVSS 4.0, and the record shows no KEV listing or confirmed exploitation in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

AsyncHttpClient (AHC) is a Java library for executing HTTP requests and handling responses asynchronously. According to the GitHub advisory, when a request is replayed across hosts, the current request is updated but the target request and related proxy context keep pointing at the original origin. The issue is classified as CWE-319, Cleartext Transmission of Sensitive Information.

Impact

  • The record states that connection-pool selection, CONNECT handling, realm selection, and TLS setup can send the original host's path, Host header, Authorization credentials, or plaintext request to the replay destination.
  • The CVSS 4.0 vector in the record marks confidentiality and integrity impact as high and availability impact as none.
  • Documented ResponseFilter failover and retry paths can trigger the replay, according to the record.

Affected products and versions

  • The record states the issue affects versions prior to 3.0.13 and prior to 2.16.1 of AsyncHttpClient.
  • The record states the issue is fixed in version 3.0.13 and version 2.16.1.
  • The structured affected and fixes fields in the record are empty, so the version ranges above come from the description text only.

Exploitation status

  • The record shows the CVE is not listed in the CISA KEV catalog.
  • No confirmed exploitation appears in the sources consulted for this analysis.
  • The EPSS probability in the record is 0.00189 with a percentile of 0.07876, dated 2026-10-13.

Remediation and mitigation

  • Upgrade AsyncHttpClient to 3.0.13 or 2.16.1, depending on the release line in use, as listed in the commit history.
  • Review applications that use ResponseFilter failover or retry logic, since the record says these paths can trigger the replay.
  • Until upgrading is possible, review whether credentials or sensitive data are sent through clients that follow cross-host replays, and limit exposure where feasible.
  • Review proxy configurations used with AHC, since the record cites proxy context as part of the problem.

Detection guidance

  • Review application logs and network telemetry for outbound requests from AHC-based services to hosts that were not expected for a given operation, especially after retry or failover events.
  • Look for unexpected Host header values or plaintext connections to internal or external destinations from services that should use TLS.
  • Inventory dependency versions to identify services still running releases before 3.0.13 or 2.16.1.

Limitations of the available information

  • The record does not include structured affected product, version, or fix data, and the affected range is inferred from the description text.
  • The record does not include a detailed technical walkthrough, and this analysis does not provide one.
  • Vendor-independent confirmation of exploitation, real-world impact, and the exact conditions required in production deployments is unknown from the sources consulted.

Frequently asked questions

Which AsyncHttpClient versions are fixed for CVE-2026-107282?

The record states the issue is fixed in versions 3.0.13 and 2.16.1, and versions prior to those are described as affected.

Is this CVE known to be exploited in the wild?

The record shows the CVE is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.