CVE-2026-107284Low· 3.7▾ Sunlit

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score20/ 100 · Low

impact 20.4 · likelihood 0 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Oct 7, 2026

Updated

Oct 7, 2026

CVSS

3.7

Vendor

AsyncHttpClient

Product

async-http-client

CWE

CWE-345, CWE-670

Depth score

20 · Low

EPSS

—

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

AsyncHttpClient CWE-345 CWE-670 #nvd #cve.org

Affected

async-http-client >= 3.0.0, < 3.0.12
async-http-client >= 2.0.0, < 2.16.1

Full technical detail▾

Overview

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, WebSocketHandler.upgrade aborts a handshake whose Sec-WebSocket-Accept value is missing or invalid but continues into pipeline installation and onOpen delivery. Frames coalesced with the invalid 101 response can be decoded and delivered from a peer that did not prove the handshake, although the request future fails and the channel closes. This issue is fixed in versions 3.0.12 and 2.16.1.

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd#cve.org