Read the docs
TI-2026-69314 Aliases CVE-2026-107230GHSA-v2j5-22fr-j62r

Pooled connections shared across logins in AsyncHttpClient

Priority LOW 34CWE-346Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-346.

Summary

AsyncHttpClient versions from 2.0.0 through 2.16.1 and from 3.0.0 before 3.0.14 are affected. Connection pool partitioning omits identity-defining fields for Kerberos, SPNEGO, NTLM and authenticated proxy connections (CWE-346). A remote attacker with no privileges or user interaction can, in certain login setups, get a later request run under another identity and expose that identity's data or authority.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 3.0.14, connection-pool partitioning still omits identity-defining fields for Kerberos, SPNEGO, NTLM, and authenticated proxy connections. Logins without a configured principal, proxy realms, identities sharing a user name, and SOCKS or CONNECT proxy logins can reuse a socket authenticated as a different identity. A later request is then executed under the first identity and can expose that identity's data or authority to another caller. In the affected execution path, SpnegoEngine, NTLM, Kerberos, SPNEGO, SOCKS, and CONNECT control or expose the vulnerable behavior. This issue is fixed in version 3.0.14.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00188 8th percentileScored 2026-11-07
Fix Fixed async-http-client (AsyncHttpClient): 3.0.14org.asynchttpclient:async-http-client (Maven): 3.0.14

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AsyncHttpClientasync-http-client3.0.0 to before 3.0.14; 2.0.0 – 2.16.13.0.14Patch availableCNA
—org.asynchttpclient:async-http-client (Maven)3.0.0 to before 3.0.143.0.14Patch availableGHSA-v2j5-22fr-j62r
—org.asynchttpclient:async-http-client (Maven)2.0.0 – 2.16.1—No fix listedGHSA-v2j5-22fr-j62r
  • async-http-client VendorAsyncHttpClient Affected 3.0.0 to before 3.0.14; 2.0.0 – 2.16.1 Fixed in 3.0.14 Patch available CNA
  • org.asynchttpclient:async-http-client (Maven) Vendor— Affected 3.0.0 to before 3.0.14 Fixed in 3.0.14 Patch available GHSA-v2j5-22fr-j62r
  • org.asynchttpclient:async-http-client (Maven) Vendor— Affected 2.0.0 – 2.16.1 Fixed in — No fix listed GHSA-v2j5-22fr-j62r

Remediation

Upgrade org.asynchttpclient:async-http-client to 3.0.14, which fixes this issue. The sources list no fixed version for async-http-client.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA async-http-client (AsyncHttpClient) Fixed in 3.0.14
  • Fix · GHSA-v2j5-22fr-j62r org.asynchttpclient:async-http-client (Maven) Fixed in 3.0.14 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat Fuse 7

Timeline

  1. 2026-10-07 Threatist record created from CVE-2026-107230
  2. 2026-10-08 Alias added: GHSA-v2j5-22fr-j62r
  3. 2026-10-08 Fix available: Maven/org.asynchttpclient:[email protected] · GHSA-v2j5-22fr-j62r
  4. 2026-10-08 CVSS score added · GHSA-v2j5-22fr-j62r
  5. 2026-10-08 Weakness changed · GHSA-v2j5-22fr-j62r
  6. 2026-10-08 5 new references · GHSA-v2j5-22fr-j62r
  7. 2026-10-08 CISA SSVC decision points changed
  8. 2026-10-08 Priority changed: MEDIUM → LOW
  9. 2026-10-09 Affected versions changed · Red Hat
  10. 2026-10-09 CVSS score added · Red Hat

References

Advisory 1

Other 4

  • TI-2024-36149 AsyncHttpClient (AHC) library's `CookieStore` replaces explicitly defined `Cookie`s CVSS 4.0CRITICAL 9.2
  • TI-2026-69321 Cross-host replay in AsyncHttpClient leaks credentials to new host CVSS 4.0CRITICAL 9.4
  • TI-2026-69315 AsyncHttpClient sends passwords in cleartext after Digest downgrade CVSS 4.0HIGH 8.7
  • TI-2026-58825 AsyncHttpClient: Unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of service CVSS 3.1HIGH 7.5
  • TI-2026-69311 Unbounded WebSocket decompression in AsyncHttpClient enables DoS CVSS 3.1HIGH 7.5
  • TI-2026-58823 AsyncHttpClient: SOCKS proxy credentials sent to the origin server over plaintext HTTP CVSS 3.1HIGH 7.5
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences