AsyncHttpClient: Connection permit leak on TLS handshake failure causes per-host denial of service
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 1 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-400.
Summary
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 3.0.8 until 3.0.12, a client with maxConnections or maxConnectionsPerHost set above zero leaks one connection permit whenever TLS connection establishment fails before the handshake completes. NettyConnectListener removes the partitionKeyLock permit from NettyResponseFuture before every failure path is bound to the channel closeFuture, so an abort can leave the permit unreleased. Repeated failures can permanently lock out one host under a per-host limit or drain the shared pool under a global limit, blocking later requests even when no connection remains open. The default unlimited connection setting is not affected. This issue is fixed in version 3.0.12.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| AsyncHttpClient | async-http-client | 3.0.8 to before 3.0.12 | 3.0.12 | Patch available | CNA |
- async-http-client VendorAsyncHttpClient Affected 3.0.8 to before 3.0.12 Fixed in 3.0.12 Patch available CNA
Remediation
- Fix · CNA async-http-client (AsyncHttpClient) Fixed in 3.0.12
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Fuse 7 | Affected | No fix planned: Out of support scope |
Timeline
- 2026-10-02 Threatist record created from CVE-2026-85718
References
Other 4
- https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-gcmv-gr82-6m8v
- https://github.com/AsyncHttpClient/async-http-client/issues/2189
- https://github.com/AsyncHttpClient/async-http-client/pull/2288
- https://github.com/AsyncHttpClient/async-http-client/commit/64eb57af52a003ae7f29a2f9f4502271bbb138dd
More AsyncHttpClient vulnerabilities
- TI-2024-36149 AsyncHttpClient (AHC) library's `CookieStore` replaces explicitly defined `Cookie`s CVSS 4.0CRITICAL 9.2
- TI-2026-69321 Cross-host replay in AsyncHttpClient leaks credentials to new host CVSS 4.0CRITICAL 9.4
- TI-2026-69315 AsyncHttpClient sends passwords in cleartext after Digest downgrade CVSS 4.0HIGH 8.7
- TI-2026-58825 AsyncHttpClient: Unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of service CVSS 3.1HIGH 7.5
- TI-2026-69311 Unbounded WebSocket decompression in AsyncHttpClient enables DoS CVSS 3.1HIGH 7.5
- TI-2026-58823 AsyncHttpClient: SOCKS proxy credentials sent to the origin server over plaintext HTTP CVSS 3.1HIGH 7.5
Sources
- CVE-2026-85718 · CVE Program
- CVE-2026-85718 · NVD
- FIRST EPSS
- CVE-2026-85718 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences