Vulnerabilidades do Maven Org.asynchttpclient:async-http-client

🔔 Criar alerta RSS Verificador de versão

CVEs publicadas que afetam Maven Org.asynchttpclient:async-http-client: 6 registro(s), com versões afetadas e correções.

CVE-2026-107226 Média · 6.8 CWE-384 12/10/2026

AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPS

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 3.0.14, the default ThreadSafeCookieStore does not retain whether a Set-Cookie response used a secure transport. It accepts Secure cookies received over plaintext and permits insecure cookies to overlay or delete existing Secure cookies with matching scope. An attacker controlling a plaintext same-site response can consequently plant, replace, or remove cookie state later sent to an HTTPS origin, enabling session fixation, CSRF-token replacement, or loss of security-relevant state. This issue is fixed in version 3.0.14.

CVE-2026-107285 Média · 5.9 CWE-319 07/10/2026

AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, a proxied ws request is carried through CONNECT, but NettyRequestFactory.newNettyRequest and requestUri decide whether to attach proxy authentication and an absolute-form target only from whether the URI is secure. Because ws is not marked secure, the tunneled WebSocket upgrade sent to the origin includes the proxy's Proxy-Authorization value. Basic credentials are directly recoverable and Digest responses can be replayed or cracked offline. This issue is fixed in versions 3.0.12 and 2.16.1.

CVE-2026-107283 Baixa · 3.7 CWE-338 07/10/2026

AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random source

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, Realm.Builder generates the HTTP Digest client nonce with ThreadLocalRandom rather than a cryptographically secure random source. Digest relies on an unpredictable cnonce to resist chosen-plaintext and credential precomputation attacks, so an observer able to infer generator state can reduce the protection of the authentication exchange. This issue is fixed in versions 3.0.12 and 2.16.1.

CVE-2026-107282 Crítica · 9.4 CWE-319 07/10/2026

AsyncHttpClient: reexecução de requisição entre hosts expõe credenciais e tráfego

A biblioteca AsyncHttpClient (AHC) permite que aplicações Java executem requisições HTTP com facilidade e processem respostas HTTP de forma assíncrona. Antes das versões 3.0.13 e 2.16.1, a reexecução de requisição entre hosts atualiza a requisição atual, mas deixa a requisição alvo e o contexto de proxy relacionado apontando para a origem original. A seleção de pool de conexões, o tratamento de CONNECT, a seleção de realm e a configuração de TLS podem, consequentemente, enviar o caminho, o cabeçalho Host, as credenciais Authorization do host original ou a requisição em texto plano para o destino da reexecução. Caminhos documentados de failover e retry com ResponseFilter podem disparar a reexecução. Esta questão está corrigida nas versões 3.0.13 e 2.16.1.

CVE-2026-107280 Média · 6.9 CWE-1275 07/10/2026

AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.uk

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, ThreadSafeCookieStore validates Domain attributes with domain matching but does not reject public suffixes. A host beneath a suffix such as co.uk can set a cookie for that suffix, after which the shared cookie store sends it to unrelated hosts under the suffix. This can inject or overwrite session-relevant cookie values across origins. This issue is fixed in versions 3.0.13 and 2.16.1.

CVE-2026-107230 Alta · 7.4 CWE-346 07/10/2026

AsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy logins

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 3.0.14, connection-pool partitioning still omits identity-defining fields for Kerberos, SPNEGO, NTLM, and authenticated proxy connections. Logins without a configured principal, proxy realms, identities sharing a user name, and SOCKS or CONNECT proxy logins can reuse a socket authenticated as a different identity. A later request is then executed under the first identity and can expose that identity's data or authority to another caller. In the affected execution path, SpnegoEngine, NTLM, Kerberos, SPNEGO, SOCKS, and CONNECT control or expose the vulnerable behavior. This issue is fixed in version 3.0.14.