AsyncHttpClient

Records24All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical2CVSS 9.0–10.0

CVSS high8CVSS 7.0–8.9

Exploited now

AsyncHttpClient records in CISA KEV

No AsyncHttpClient vulnerabilities are listed in CISA KEV.

Records

24 records

TI-2024-36149 CVE-2024-53990 · GHSA-mfj5-cf8g-g2fv

AsyncHttpClient (AHC) library's `CookieStore` replaces explicitly defined `Cookie`s

HIGH 73

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00722 Published 2024-12-02 Partial fix · 3.0.1, 2.12.4 CWE-287

TI-2026-69321 CVE-2026-107282 · GHSA-jmqq-x5g9-9p2w

Cross-host replay in AsyncHttpClient leaks credentials to new host

MEDIUM 48

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses.

CVSS 4.0CRITICAL 9.4 Network No auth No interaction EPSS 0.00189 Published 2026-10-07 Fixed in 3.0.13, 2.16.1 CWE-319

TI-2026-69315 CVE-2026-107231 · GHSA-rqf5-2wxv-rjf4

AsyncHttpClient sends passwords in cleartext after Digest downgrade

MEDIUM 45

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00237 Published 2026-10-07 Fixed in 3.0.13, 2.16.1 CWE-319

TI-2026-58825 CVE-2026-85721 · GHSA-7grg-jcf7-rpmx

AsyncHttpClient: Unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of service

MEDIUM 40

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0063 Published 2026-09-17 Fixed in 2.16.1, 3.0.12 CWE-400

TI-2026-69311 CVE-2026-107227 · GHSA-x8v2-478q-2hvg

Unbounded WebSocket decompression in AsyncHttpClient enables DoS

LOW 39

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00426 Published 2026-10-07 Fixed in 3.0.14 CWE-400

TI-2026-58823 CVE-2026-85719

AsyncHttpClient: SOCKS proxy credentials sent to the origin server over plaintext HTTP

LOW 39

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00361 Published 2026-09-17 Fixed in 2.16.1, 3.0.12 CWE-319

TI-2026-69317 CVE-2026-107279

AsyncHttpClient skips Digest mutual authentication for qop=auth-int

LOW 38

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00358 Published 2026-10-07 No fix listed CWE-303

TI-2026-69316 CVE-2026-107232

AsyncHttpClient leaks credentials to proxy after CONNECT rejection

LOW 38

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00213 Published 2026-10-07 Fixed in 3.0.12, 2.16.1 CWE-319

TI-2026-69319 CVE-2026-107281

Connection reuse in AsyncHttpClient runs requests as another identity

LOW 34

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses.

CVSS 4.0HIGH 7.6 Network Low privileges No interaction EPSS 0.00171 Published 2026-10-07 Partial fix · 3.0.13, 2.16.1 CWE-346

TI-2026-69314 CVE-2026-107230 · GHSA-v2j5-22fr-j62r

Pooled connections shared across logins in AsyncHttpClient

LOW 34

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00188 Published 2026-10-07 Fixed in 3.0.14 CWE-346

TI-2026-69312 CVE-2026-107228 · GHSA-2jwh-9rmr-j4xf

AsyncHttpClient cookie store overrides a caller's Cookie header

LOW 32

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses.

CVSS 3.1MEDIUM 6.8 Network Low privileges No interaction EPSS 0.00301 Published 2026-10-07 Partial fix · 3.0.14 CWE-287

TI-2026-58821 CVE-2026-85717 · GHSA-f8m2-889x-vw4x

AsyncHttpClient: Client-wide realm credentials re-sent to a cross-origin redirect target

LOW 31

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses.

CVSS 3.1MEDIUM 6.8 Network No auth No interaction EPSS 0.0053 Published 2026-09-17 Partial fix · 2.16.1, 3.0.12 CWE-200

TI-2026-71226 CVE-2026-107226

AsyncHttpClient lets plaintext HTTP overwrite Secure cookies

LOW 30

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses.

CVSS 3.1MEDIUM 6.8 Network No auth No interaction EPSS 0.00294 Published 2026-10-12 Partial fix · 3.0.14 CWE-384

TI-2026-69318 CVE-2026-107280 · GHSA-f9m8-cv68-674w

AsyncHttpClient accepts cookies for public suffixes such as co.uk

LOW 30

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00261 Published 2026-10-07 Partial fix · 3.0.13, 2.16.1 CWE-1275

TI-2026-29241 CVE-2026-40490 · GHSA-cmxv-58fp-fm3g

AsyncHttpClient leaks authorization credentials to untrusted domains on cross-origin redirects

LOW 30

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses.

CVSS 3.1MEDIUM 6.8 Network No auth No interaction EPSS 0.00415 Published 2026-04-18 Partial fix · 3.0.9, 2.14.5 CWE-200

TI-2026-58822 CVE-2026-85718

AsyncHttpClient: Connection permit leak on TLS handshake failure causes per-host denial of service

LOW 27

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00533 Published 2026-09-17 Partial fix · 3.0.12 CWE-400

TI-2026-69324 CVE-2026-107285 · GHSA-3wp9-xfwm-rjjf

AsyncHttpClient leaks proxy credentials to origin over WebSocket

LOW 26

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00206 Published 2026-10-07 Partial fix · 3.0.12, 2.16.1 CWE-319

TI-2026-58824 CVE-2026-85720 · GHSA-xr57-gcx8-52hf

AsyncHttpClient: Origin credentials sent to the proxy on the plaintext CONNECT request

LOW 26

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00265 Published 2026-09-17 Partial fix · 2.16.1, 3.0.12 CWE-319

TI-2026-74852 CVE-2026-102740

Predictable shared file in AsyncHttpClient follows symlinks

LOW 25

The AsyncHttpClient library allows Java applications to execute HTTP requests and asynchronously process HTTP responses.

CVSS 3.1MEDIUM 5.8 Local Low privileges No interaction EPSS 0.001 Published 2026-10-15 Partial fix · 2.16.1, 3.0.12 CWE-379

TI-2026-40203 CVE-2026-55688 · GHSA-m452-q8c9-rg2f

AsyncHttpClient: Cookie stored for an unrelated domain (cookie tossing) via ThreadSafeCookieStore

LOW 19

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses.

CVSS 3.1MEDIUM 4.0 Network No auth No interaction EPSS 0.0033 Published 2026-07-01 Partial fix · 2.16.0, 3.0.11 CWE-1275

TI-2026-69313 CVE-2026-107229

AsyncHttpClient cookie store lets one origin set cookies for another

LOW 18

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses.

CVSS 3.1MEDIUM 4.0 Network No auth No interaction EPSS 0.00261 Published 2026-10-07 Partial fix · 3.0.14 CWE-1275

TI-2026-58820 CVE-2026-85716 · GHSA-fj9w-c36g-h5x8

AsyncHttpClient: SCRAM and Digest mutual-authentication responses are not verified

LOW 18

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses.

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00409 Published 2026-09-17 Partial fix · 3.0.12 CWE-287

TI-2026-69323 CVE-2026-107284

AsyncHttpClient WebSocket handshake proceeds after failed accept check

LOW 17

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses.

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00138 Published 2026-10-07 Partial fix · 3.0.12, 2.16.1 CWE-345

TI-2026-69322 CVE-2026-107283 · GHSA-mfj3-87qq-382v

Weak random source for Digest nonce in AsyncHttpClient

LOW 17

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses.

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00263 Published 2026-10-07 Partial fix · 3.0.12, 2.16.1 CWE-338

Open these records in search →

Critical	2
High	8
Medium	11
Low	3
No CVSS	0