CVE-2026-107283Low· 3.7▾ Sunlit

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score20/ 100 · Low

impact 20.4 · likelihood 0 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Oct 7, 2026

Updated

Oct 7, 2026

CVSS

3.7

Vendor

AsyncHttpClient

Product

async-http-client

CWE

CWE-338

Depth score

20 · Low

EPSS

—

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

AsyncHttpClient CWE-338 #nvd #cve.org

Affected

async-http-client >= 3.0.0, < 3.0.12
async-http-client >= 2.0.0, < 2.16.1

Full technical detail▾

Overview

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, Realm.Builder generates the HTTP Digest client nonce with ThreadLocalRandom rather than a cryptographically secure random source. Digest relies on an unpredictable cnonce to resist chosen-plaintext and credential precomputation attacks, so an observer able to infer generator state can reduce the protection of the authentication exchange. This issue is fixed in versions 3.0.12 and 2.16.1.

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd#cve.org