{"id":"CVE-2026-85717","aliases":["CLSA-2026-1791926769","EUVD-2026-81905","GHSA-f8m2-889x-vw4x","UBUNTU-CVE-2026-85717"],"status":"published","title":"AsyncHttpClient: Client-wide realm credentials re-sent to a cross-origin redirect target","description":"The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.14.5 to 2.16.0 and from 3.0.9 to 3.0.11, a client configured with a client-wide Realm and redirect following can disclose credentials after a cross-origin redirect because the Interceptors authentication path falls back to the client configuration after redirect handling clears the per-exchange realm. If the attacker-controlled target returns 401, the client can send Basic or Digest credentials or a Negotiate or NTLM token to that origin. Per-request realms are stripped correctly, and this issue is a residual bypass of the earlier cross-origin credential-stripping fixes. This issue is fixed in versions 2.16.1 and 3.0.12.","severity":{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.0053,"percentile":0.453,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200","CWE-522"],"published":"2026-09-17T15:53:39Z","modified":"2026-10-28T11:18:54Z","fixes":[{"ecosystem":"Maven","package":"org.asynchttpclient:async-http-client","fixed_in":["3.0.12","2.16.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.asynchttpclient:async-http-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.9"},{"last_affected":"3.0.11"},{"fixed":"3.0.12"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.asynchttpclient:async-http-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.14.5"},{"last_affected":"2.16.0"},{"fixed":"2.16.1"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.asynchttpclient:async-http-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.1"},{"fixed":"2.12.1-tuxcare.1"}]}],"versions":["2.12.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.asynchttpclient:async-http-client-bom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.1"},{"fixed":"2.12.1-tuxcare.1"}]}],"versions":["2.12.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.asynchttpclient:async-http-client-example","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.1"},{"fixed":"2.12.1-tuxcare.1"}]}],"versions":["2.12.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.asynchttpclient:async-http-client-extras-guava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.1"},{"fixed":"2.12.1-tuxcare.1"}]}],"versions":["2.12.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.asynchttpclient:async-http-client-extras-jdeferred","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.1"},{"fixed":"2.12.1-tuxcare.1"}]}],"versions":["2.12.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.asynchttpclient:async-http-client-extras-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.1"},{"fixed":"2.12.1-tuxcare.1"}]}],"versions":["2.12.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.asynchttpclient:async-http-client-extras-registry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.1"},{"fixed":"2.12.1-tuxcare.1"}]}],"versions":["2.12.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.asynchttpclient:async-http-client-extras-retrofit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.1"},{"fixed":"2.12.1-tuxcare.1"}]}],"versions":["2.12.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.asynchttpclient:async-http-client-extras-rxjava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.1"},{"fixed":"2.12.1-tuxcare.1"}]}],"versions":["2.12.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.asynchttpclient:async-http-client-extras-rxjava2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.1"},{"fixed":"2.12.1-tuxcare.1"}]}],"versions":["2.12.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.asynchttpclient:async-http-client-extras-simple","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.1"},{"fixed":"2.12.1-tuxcare.1"}]}],"versions":["2.12.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.asynchttpclient:async-http-client-extras-typesafe-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.1"},{"fixed":"2.12.1-tuxcare.1"}]}],"versions":["2.12.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.asynchttpclient:async-http-client-netty-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.1"},{"fixed":"2.12.1-tuxcare.1"}]}],"versions":["2.12.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.asynchttpclient:async-http-client-project","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.1"},{"fixed":"2.12.1-tuxcare.1"}]}],"versions":["2.12.1"],"bundled":12},{"source":"osv","ecosystem":"Maven","package":"org.asynchttpclient:async-http-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.9"},{"fixed":"3.0.12"}]}],"versions":["3.0.10","3.0.11","3.0.9"]},{"source":"osv","ecosystem":"Maven","package":"org.asynchttpclient:async-http-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.14.5"},{"fixed":"2.16.1"}]}],"versions":["2.14.5","2.15.0","2.16.0"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"async-http-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.5-1","1.6.5-2","1.6.5-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"async-http-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.5-4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"async-http-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.5-4","1.6.5-5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"async-http-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.6.0-1","2.6.0-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"async-http-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.12.2-1","2.12.3-1","2.12.3-1ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"async-http-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.12.3-1","2.12.3-1ubuntu0.24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"async-http-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.12.3-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"async-http-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.12.3-1","2.12.3-1ubuntu1","2.12.3-1ubuntu1.1"]}],"products":[{"vendor":"asynchttpclient","product":"async-http-client"}],"references":[{"url":"https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-f8m2-889x-vw4x","tags":["x_refsource_CONFIRM","advisory","web","report"]},{"url":"https://github.com/AsyncHttpClient/async-http-client/pull/2224","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/AsyncHttpClient/async-http-client/commit/43db7bba81430cbd61ec2dc2c7be464e0ff6a0ff","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/AsyncHttpClient/async-http-client/commit/b66757bec34def2e9867bb2b77bd848b1112abb4","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/advisories/GHSA-f8m2-889x-vw4x"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85717.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85717","tags":["advisory"]},{"url":"https://github.com/AsyncHttpClient/async-http-client","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-85717","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-85717","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-85717","title":"AsyncHttpClient: Client-wide realm credentials re-sent to a cross-origin redirect target","description":"The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.14.5 to 2.16.0 and from 3.0.9 to 3.0.11, a client configured with a client-wide Realm and redirect following can disclose credentials after a cross-origin redirect because the Interceptors authentication path falls back to the client configuration after redirect handling clears the per-exchange realm. If the attacker-controlled target returns 401, the client can send Basic or Digest credentials or a Negotiate or NTLM token to that origin. Per-request realms are stripped correctly, and this issue is a residual bypass of the earlier cross-origin credential-stripping fixes. This issue is fixed in versions 2.16.1 and 3.0.12.","status":"published","published":"2026-09-17T15:53:39.875Z","modified":"2026-09-23T18:46:54.135Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-200","CWE-522"],"updated_at":"2026-11-02T14:19:52.016971Z"}],"euvd":[{"id":"EUVD-2026-81905","description":"The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.14.5 to 2.16.0 and from 3.0.9 to 3.0.11, a client configured with a client-wide Realm and redirect following can disclose credentials after a cross-origin redirect because the Interceptors authentication path falls back to the client configuration after redirect handling clears the per-exchange realm. If the attacker-controlled target returns 401, the client can send Basic or Digest credentials or a Negotiate or NTLM token to that origin. Per-request realms are stripped correctly, and this issue is a residual bypass of the earlier cross-origin credential-stripping fixes. This issue is fixed in versions 2.16.1 and 3.0.12.","status":"published","published":"2026-09-17T15:53:39Z","modified":"2026-09-23T18:46:54Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T17:28:00.170339Z"}],"ghsa":[{"id":"GHSA-f8m2-889x-vw4x","title":"AsyncHttpClient re-sends client-wide realm credentials to a cross-origin redirect target","description":"### Impact\nA client configured with a client-wide realm (a Realm set on the config builder rather than on an individual request) and following redirects could re-send those credentials to a redirect target on a different origin. The redirect code strips the per-exchange realm, but when the target answered 401 the credentials were re-derived from the client config, handing Basic or Digest credentials, or a Negotiate or NTLM token, to an attacker controlled origin. This is a residual of the earlier cross-origin credential leak advisories, whose strip this bypassed.\n\n### Affected versions\n* 3.x: 3.0.9 through 3.0.11\n* 2.x: 2.14.5 through 2.16.0\n\nReleases below those floors are covered by the earlier advisories GHSA-cmxv-58fp-fm3g and GHSA-fmxf-pm6p-7xgm: the cross-origin strip that this issue bypasses did not exist yet, so the leak there is the original one rather than this residual.\n\n### Patches\nFixed in 3.0.12 on the 3.x line and in 2.16.1 on the 2.x line. The realm is taken from the per-exchange state that the redirect already cleared, rather than being re-derived from the client configuration.\n\n### Workarounds\nSet the Realm on the individual request instead of on the client configuration. A per-request realm is stripped correctly on a cross-origin redirect while still authenticating same-origin, so this is a complete workaround with no loss of function. Turning off follow-redirects also avoids it. Note that setStripAuthorizationOnRedirect(true) is not a workaround: it forces the strip, but the configuration fallback re-derived the realm regardless.\n\n### Details\nThe interceptor read the realm as the request's realm or, failing that, the client configuration's realm, which re-attached the config realm after the redirect strip had cleared it. It now reads the realm held on the response future. See also GHSA-cmxv-58fp-fm3g and GHSA-fmxf-pm6p-7xgm.","status":"published","published":"2026-09-17T17:19:31Z","modified":"2026-09-17T17:19:33Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200","CWE-522"],"updated_at":"2026-11-02T14:41:18.357514Z"}],"nvd":[{"id":"CVE-2026-85717","description":"The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.14.5 to 2.16.0 and from 3.0.9 to 3.0.11, a client configured with a client-wide Realm and redirect following can disclose credentials after a cross-origin redirect because the Interceptors authentication path falls back to the client configuration after redirect handling clears the per-exchange realm. If the attacker-controlled target returns 401, the client can send Basic or Digest credentials or a Negotiate or NTLM token to that origin. Per-request realms are stripped correctly, and this issue is a residual bypass of the earlier cross-origin credential-stripping fixes. This issue is fixed in versions 2.16.1 and 3.0.12.","status":"published","published":"2026-09-17T16:18:15.96Z","modified":"2026-09-30T17:31:44.573Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-200","CWE-522"],"updated_at":"2026-11-02T14:12:49.013904Z"}],"osv":[{"id":"CVE-2026-85717","title":"AsyncHttpClient: Client-wide realm credentials re-sent to a cross-origin redirect target","description":"The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.14.5 to 2.16.0 and from 3.0.9 to 3.0.11, a client configured with a client-wide Realm and redirect following can disclose credentials after a cross-origin redirect because the Interceptors authentication path falls back to the client configuration after redirect handling clears the per-exchange realm. If the attacker-controlled target returns 401, the client can send Basic or Digest credentials or a Negotiate or NTLM token to that origin. Per-request realms are stripped correctly, and this issue is a residual bypass of the earlier cross-origin credential-stripping fixes. This issue is fixed in versions 2.16.1 and 3.0.12.","status":"published","published":"2026-09-17T15:53:39.875Z","modified":"2026-10-28T11:18:54.045342739Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200","CWE-522"],"updated_at":"2026-11-02T15:45:18.825071Z"},{"id":"GHSA-f8m2-889x-vw4x","title":"AsyncHttpClient re-sends client-wide realm credentials to a cross-origin redirect target","description":"### Impact\nA client configured with a client-wide realm (a Realm set on the config builder rather than on an individual request) and following redirects could re-send those credentials to a redirect target on a different origin. The redirect code strips the per-exchange realm, but when the target answered 401 the credentials were re-derived from the client config, handing Basic or Digest credentials, or a Negotiate or NTLM token, to an attacker controlled origin. This is a residual of the earlier cross-origin credential leak advisories, whose strip this bypassed.\n\n### Affected versions\n* 3.x: 3.0.9 through 3.0.11\n* 2.x: 2.14.5 through 2.16.0\n\nReleases below those floors are covered by the earlier advisories GHSA-cmxv-58fp-fm3g and GHSA-fmxf-pm6p-7xgm: the cross-origin strip that this issue bypasses did not exist yet, so the leak there is the original one rather than this residual.\n\n### Patches\nFixed in 3.0.12 on the 3.x line and in 2.16.1 on the 2.x line. The realm is taken from the per-exchange state that the redirect already cleared, rather than being re-derived from the client configuration.\n\n### Workarounds\nSet the Realm on the individual request instead of on the client configuration. A per-request realm is stripped correctly on a cross-origin redirect while still authenticating same-origin, so this is a complete workaround with no loss of function. Turning off follow-redirects also avoids it. Note that setStripAuthorizationOnRedirect(true) is not a workaround: it forces the strip, but the configuration fallback re-derived the realm regardless.\n\n### Details\nThe interceptor read the realm as the request's realm or, failing that, the client configuration's realm, which re-attached the config realm after the redirect strip had cleared it. It now reads the realm held on the response future. See also GHSA-cmxv-58fp-fm3g and GHSA-fmxf-pm6p-7xgm.","status":"published","published":"2026-09-17T17:19:31Z","modified":"2026-09-17T17:30:07.592190101Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200","CWE-522"],"updated_at":"2026-11-02T15:46:46.006631Z"},{"id":"UBUNTU-CVE-2026-85717","description":"The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.14.5 to 2.16.0 and from 3.0.9 to 3.0.11, a client configured with a client-wide Realm and redirect following can disclose credentials after a cross-origin redirect because the Interceptors authentication path falls back to the client configuration after redirect handling clears the per-exchange realm. If the attacker-controlled target returns 401, the client can send Basic or Digest credentials or a Negotiate or NTLM token to that origin. Per-request realms are stripped correctly, and this issue is a residual bypass of the earlier cross-origin credential-stripping fixes. This issue is fixed in versions 2.16.1 and 3.0.12.","status":"published","published":"2026-09-17T16:18:00Z","modified":"2026-10-17T13:01:13.731320469Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:57:24.828975Z"},{"id":"CLSA-2026-1791926769","title":"TuxCare security update for org.asynchttpclient (13 CVEs)","description":"TuxCare rebuilt 14 org.asynchttpclient packages to address 13 CVEs. Fixed in 2.12.1-tuxcare.1.","status":"published","published":"2026-10-13T21:26:09Z","modified":"2026-10-15T09:47:45.855594885Z","updated_at":"2026-11-02T15:43:50.599064Z"}]}}