Read the docs
TI-2026-58820 Aliases CVE-2026-85716GHSA-fj9w-c36g-h5x8

AsyncHttpClient: SCRAM and Digest mutual-authentication responses are not verified

Priority LOW 18CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · None
Fix status
Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-287.

Summary

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 3.0.8 until 3.0.12, processScramAuthenticationInfo and processAuthenticationInfo compute the SCRAM ServerSignature or Digest rspauth verification result but log a mismatch and still deliver the response as authenticated. On a non-TLS or compromised transport, a peer that has not proved knowledge of the shared secret can therefore be accepted as the server. The fix rejects a present invalid value and computes Digest rspauth from the Authorization parameters actually sent, but verification remains unenforced when the value is absent, the sent parameters cannot be recovered, or Digest uses qop=auth-int. This issue is fixed in version 3.0.12.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00409 35th percentileScored 2026-11-07
Fix Partial async-http-client (AsyncHttpClient): 3.0.12org.asynchttpclient:async-http-client (Maven): 3.0.12Red Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AsyncHttpClientasync-http-client3.0.8 to before 3.0.123.0.12Patch availableCNA
—org.asynchttpclient:async-http-client (Maven)3.0.8 to before 3.0.123.0.12Patch availableGHSA-fj9w-c36g-h5x8
  • async-http-client VendorAsyncHttpClient Affected 3.0.8 to before 3.0.12 Fixed in 3.0.12 Patch available CNA
  • org.asynchttpclient:async-http-client (Maven) Vendor— Affected 3.0.8 to before 3.0.12 Fixed in 3.0.12 Patch available GHSA-fj9w-c36g-h5x8

Remediation

  • Fix · CNA async-http-client (AsyncHttpClient) Fixed in 3.0.12
  • Fix · GHSA-fj9w-c36g-h5x8 org.asynchttpclient:async-http-client (Maven) Fixed in 3.0.12 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Fuse 7AffectedNo fix planned: Out of support scope

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-85716
  2. 2026-10-03 Alias added: GHSA-fj9w-c36g-h5x8

References

Other 6

  • TI-2024-36149 AsyncHttpClient (AHC) library's `CookieStore` replaces explicitly defined `Cookie`s CVSS 4.0CRITICAL 9.2
  • TI-2026-69321 Cross-host replay in AsyncHttpClient leaks credentials to new host CVSS 4.0CRITICAL 9.4
  • TI-2026-69315 AsyncHttpClient sends passwords in cleartext after Digest downgrade CVSS 4.0HIGH 8.7
  • TI-2026-58825 AsyncHttpClient: Unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of service CVSS 3.1HIGH 7.5
  • TI-2026-69311 Unbounded WebSocket decompression in AsyncHttpClient enables DoS CVSS 3.1HIGH 7.5
  • TI-2026-58823 AsyncHttpClient: SOCKS proxy credentials sent to the origin server over plaintext HTTP CVSS 3.1HIGH 7.5
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences