CVE-2026-107231High· 8.7▾ Twilight

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score48/ 100 · Moderate

impact 47.8 · likelihood 0 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Oct 7, 2026

Updated

Oct 7, 2026

CVSS

8.7

Vendor

AsyncHttpClient

Product

async-http-client

CWE

CWE-319, CWE-522, CWE-757

Depth score

48 · Moderate

EPSS

—

Platforms

—

Source

NVD

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

AsyncHttpClient CWE-319 CWE-522 CWE-757 #nvd #cve.org

Affected

async-http-client >= 3.0.0.Beta1, < 3.0.13
async-http-client >= 2.0.0, < 2.16.1

Full technical detail▾

Overview

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, Realm.Builder treats a Digest challenge that yields no usable nonce as a Basic challenge. A malicious origin or proxy can label a challenge Digest while omitting or emptying the nonce, causing the client to resend the username and password using reversible Basic authentication. Both origin and proxy challenge parsers are affected. This issue is fixed in versions 3.0.13 and 2.16.1.

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd#cve.org