Vulnerabilities

TI-2026-33100 CVE-2026-45300 · GHSA-fmxf-pm6p-7xgm

async-http-client: Cookie header not stripped on cross-origin redirect

HIGH 66

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses.

CVSS 3.1HIGH 7.4 Network No auth User interaction EPSS 0.00399 Published 2026-06-05 Fixed in 3.0.10, 2.15.0 CWE-200

TI-2023-00037 CVE-2023-0040 · GHSA-v3r5-pjpm-mwgq

Injection in Apple Async HTTP Client

LOW 34

Versions of Async HTTP Client prior to 1.13.2 are vulnerable to a form of targeted request manipulation called CRLF injection.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00564 Published 2023-01-18 Fixed in 1.13.2, 1.12.1 +2 CWE-93

TI-2017-10239 CVE-2017-14063 · GHSA-93jq-624g-4p9p

Async Http Client (aka async-http-client) before 2.0.35 can be tricked into connecting to…

LOW 38

Async Http Client (aka async-http-client) before 2.0.35 can be tricked into connecting to a host different from the one extracted by java.net.URI if a '?' character occurs in a fragment identifier.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.03046 Published 2017-08-31 Partial fix · 2.0.35 CWE-20

Vulnerabilities

Filters

async-http-client: Cookie header not stripped on cross-origin redirect

Injection in Apple Async HTTP Client

Async Http Client (aka async-http-client) before 2.0.35 can be tricked into connecting to…