AsyncHttpClient skips Digest mutual authentication for qop=auth-int
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- Low · High · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
The AsyncHttpClient library, async-http-client version 3.0.12, skips Digest mutual-authentication checks when a peer offers only qop=auth-int (CWE-303). An invalid rspauth value is accepted because no expected value is computed for auth-int. A peer that does not know the shared secret can be accepted as the authenticated server.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. In 3.0.12, a peer offering only Digest qop=auth-int causes mutual-authentication verification to be skipped. AuthenticatorUtils.computeExpectedRspAuth returns no expected value for auth-int, and Interceptors treats that result as unverifiable but nonfatal, so a response with an invalid rspauth value is accepted. A peer that does not know the shared secret can therefore be accepted as the authenticated server. This issue is fixed in version 3.0.13.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| AsyncHttpClient | async-http-client | = 3.0.12 | — | No fix listed | CNA |
- async-http-client VendorAsyncHttpClient Affected = 3.0.12 Fixed in — No fix listed CNA
Remediation
Upgrade async-http-client to version 3.0.13, which fixes this issue.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
Not affected: 1 product
- Red Hat Fuse 7
Timeline
- 2026-10-07 Threatist record created from CVE-2026-107279
- 2026-10-08 CISA SSVC decision points changed
- 2026-10-08 Priority changed: MEDIUM → LOW
- 2026-10-09 Affected versions changed · Red Hat
- 2026-10-09 CVSS score added · Red Hat
References
More AsyncHttpClient vulnerabilities
- TI-2024-36149 AsyncHttpClient (AHC) library's `CookieStore` replaces explicitly defined `Cookie`s CVSS 4.0CRITICAL 9.2
- TI-2026-69321 Cross-host replay in AsyncHttpClient leaks credentials to new host CVSS 4.0CRITICAL 9.4
- TI-2026-69315 AsyncHttpClient sends passwords in cleartext after Digest downgrade CVSS 4.0HIGH 8.7
- TI-2026-58825 AsyncHttpClient: Unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of service CVSS 3.1HIGH 7.5
- TI-2026-69311 Unbounded WebSocket decompression in AsyncHttpClient enables DoS CVSS 3.1HIGH 7.5
- TI-2026-58823 AsyncHttpClient: SOCKS proxy credentials sent to the origin server over plaintext HTTP CVSS 3.1HIGH 7.5
Sources
- CVE-2026-107279 · CVE Program
- CVE-2026-107279 · NVD
- FIRST EPSS
- CVE-2026-107279 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences