Read the docs
TI-2026-69316 Aliases CVE-2026-107232

AsyncHttpClient leaks credentials to proxy after CONNECT rejection

Priority LOW 38CWE-319Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-319.

Summary

AsyncHttpClient async-http-client versions from 3.0.0 before 3.0.12 and from 2.0.0 before 2.16.1 are affected. The client infers that a proxy tunnel exists from the last request method instead of the CONNECT result, so after a proxy rejects CONNECT, redirect or authentication handlers send origin requests and Authorization credentials over the plaintext proxy connection (CWE-319). A remote attacker with no privileges and no user interaction can recover Basic credentials directly, and NTLM responses may be cracked or relayed.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 on 3.x and 2.16.1 on 2.x, the client infers that an HTTP proxy tunnel exists from the last request method rather than the CONNECT result. After a proxy rejects CONNECT, redirect or authentication handlers can write an origin request and its Authorization credentials onto the still-plaintext proxy connection. Basic credentials can be recovered directly, while NTLM responses may be cracked or relayed. This issue is fixed in versions 3.0.12 and 2.16.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00213 11th percentileScored 2026-11-07
Fix Fixed async-http-client (AsyncHttpClient): 3.0.12, 2.16.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AsyncHttpClientasync-http-client3.0.0 to before 3.0.12; 2.0.0 to before 2.16.13.0.12, 2.16.1Patch availableCNA
  • async-http-client VendorAsyncHttpClient Affected 3.0.0 to before 3.0.12; 2.0.0 to before 2.16.1 Fixed in 3.0.12, 2.16.1 Patch available CNA

Remediation

Upgrade async-http-client to version 3.0.12 on the 3.x branch or to version 2.16.1 on the 2.x branch.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA async-http-client (AsyncHttpClient) Fixed in 3.0.12, 2.16.1

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat Fuse 7

Timeline

  1. 2026-10-07 Threatist record created from CVE-2026-107232
  2. 2026-10-08 CISA SSVC decision points changed
  3. 2026-10-08 Priority changed: MEDIUM → LOW
  4. 2026-10-09 Affected versions changed · Red Hat
  5. 2026-10-09 CVSS score added · Red Hat

References

Other 5

  • TI-2024-36149 AsyncHttpClient (AHC) library's `CookieStore` replaces explicitly defined `Cookie`s CVSS 4.0CRITICAL 9.2
  • TI-2026-69321 Cross-host replay in AsyncHttpClient leaks credentials to new host CVSS 4.0CRITICAL 9.4
  • TI-2026-69315 AsyncHttpClient sends passwords in cleartext after Digest downgrade CVSS 4.0HIGH 8.7
  • TI-2026-58825 AsyncHttpClient: Unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of service CVSS 3.1HIGH 7.5
  • TI-2026-69311 Unbounded WebSocket decompression in AsyncHttpClient enables DoS CVSS 3.1HIGH 7.5
  • TI-2026-58823 AsyncHttpClient: SOCKS proxy credentials sent to the origin server over plaintext HTTP CVSS 3.1HIGH 7.5
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences