---
id: CVE-2026-85716
title: >-
  The AsyncHttpClient (AHC) library allows Java applications to easily execute
  HTTP requests and asynchronously process HTTP responses
summary: >-
  The AsyncHttpClient (AHC) library allows Java applications to easily execute
  HTTP requests and asynchronously process HTTP responses. From 3.0.8 until
  3.0.12, processScramAuthenticationInfo and processAuthenticationInfo compute
  the SCRAM…
severity: low
cvss: 3.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N'
cwe:
  - CWE-287
  - CWE-390
  - CWE-347
vendor: AsyncHttpClient
product: async-http-client
affected:
  - 'async-http-client >= 3.0.8, < 3.0.12'
patched:
  - 'org.asynchttpclient:async-http-client 3.0.12'
published: '2026-09-17'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T21:16:28.120'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-85716'
references:
  - url: >-
      https://github.com/AsyncHttpClient/async-http-client/commit/10b3db9910f0bbad2ea3dc7c7553bae12bc4a5e4
    label: security-advisories@github.com
  - url: >-
      https://github.com/AsyncHttpClient/async-http-client/commit/685173afea07892462071d966ef6ce5c88cbc66f
    label: security-advisories@github.com
  - url: >-
      https://github.com/AsyncHttpClient/async-http-client/commit/7fe8700fd5b46c668cee7774624f36b87b9dd32a
    label: security-advisories@github.com
  - url: 'https://github.com/AsyncHttpClient/async-http-client/pull/2235'
    label: security-advisories@github.com
  - url: >-
      https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-fj9w-c36g-h5x8
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-fj9w-c36g-h5x8'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-85716.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-85716'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2536386'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-85716'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-85716'
tags:
  - nvd
  - cve.org
  - ghsa
  - maven
  - csaf
  - vex
  - red-hat
epss: 0.00409
epssPercentile: 0.32495
aliases:
  - GHSA-fj9w-c36g-h5x8
ecosystem: maven
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-18T14:36:35.481776Z'
ingestedAt: '2026-09-17T17:23:30.631Z'
---

## Overview

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 3.0.8 until 3.0.12, processScramAuthenticationInfo and processAuthenticationInfo compute the SCRAM ServerSignature or Digest rspauth verification result but log a mismatch and still deliver the response as authenticated. On a non-TLS or compromised transport, a peer that has not proved knowledge of the shared secret can therefore be accepted as the server. The fix rejects a present invalid value and computes Digest rspauth from the Authorization parameters actually sent, but verification remains unenforced when the value is absent, the sent parameters cannot be recovered, or Digest uses qop=auth-int. This issue is fixed in version 3.0.12.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-85716)

Affected packages:

- `org.asynchttpclient:async-http-client >= 3.0.8, <= 3.0.11`

Patched in:

- `org.asynchttpclient:async-http-client 3.0.12`

Source: https://github.com/advisories/GHSA-fj9w-c36g-h5x8

## Vendor advisories

- **Red Hat VEX** · Low · affected: Red Hat Fuse 7 · no fix planned: Red Hat Fuse 7 · updated 2026-09-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-85716.json)