---
id: CVE-2026-102740
title: >-
  The AsyncHttpClient library allows Java applications to execute HTTP requests
  and asynchronously process HTTP responses
summary: >-
  The AsyncHttpClient library allows Java applications to execute HTTP requests
  and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 and 3.0.12,
  PropertiesBasedResumableProcessor stores resumable download state at the
  predict…
severity: medium
cvss: 5.8
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L'
cwe:
  - CWE-61
  - CWE-379
  - CWE-732
vendor: AsyncHttpClient
product: async-http-client
affected:
  - 'async-http-client >= 2.0.0, < 2.16.1'
  - 'async-http-client >= 3.0.0, < 3.0.12'
published: '2026-10-15'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T19:17:13.187'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-102740'
references:
  - url: >-
      https://github.com/AsyncHttpClient/async-http-client/commit/0422e11c954c4b026e986d1458f7a7a2eab7e591
    label: security-advisories@github.com
  - url: >-
      https://github.com/AsyncHttpClient/async-http-client/commit/d945ce3357b093e74526871cd309832a717ecfda
    label: security-advisories@github.com
  - url: 'https://github.com/AsyncHttpClient/async-http-client/pull/2281'
    label: security-advisories@github.com
  - url: >-
      https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-2.16.1
    label: security-advisories@github.com
  - url: >-
      https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.12
    label: security-advisories@github.com
  - url: >-
      https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-cf59-3jcr-vfhw
    label: security-advisories@github.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-15T18:26:38.206388Z'
ingestedAt: '2026-10-15T18:23:58.443Z'
---

## Overview

The AsyncHttpClient library allows Java applications to execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 and 3.0.12, PropertiesBasedResumableProcessor stores resumable download state at the predictable shared path $java.io.tmpdir/ahc/ResumableAsyncHandler.properties with default permissions and link-following file operations. A local user who can read the shared store can see download URLs, including embedded user information or query tokens. A local user who can write within or pre-create the affected shared store directory can plant a symbolic link that the client follows when saving state, truncating and overwriting a target file writable by the client process. The filesystem path is used when ResumableAsyncHandler decorates another AsyncHandler, while the no-argument constructors use a no-op processor and are unaffected. This issue is fixed in versions 2.16.1 and 3.0.12.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.