io.root.org.asynchttpclient:async-http-client vulnerabilities (Root)

6 vulnerabilities.

• io.root.org.asynchttpclient:async-http-client Root AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host CVE-2026-107282 Fix available 9.4 CriticalOctober 7, 2026
• io.root.org.asynchttpclient:async-http-client Root AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext CVE-2026-107231 Fix available 8.7 HighOctober 7, 2026
• io.root.org.asynchttpclient:async-http-client Root AsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy logins CVE-2026-107230 Fix available 7.4 HighOctober 7, 2026
• io.root.org.asynchttpclient:async-http-client Root AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabled CVE-2026-107227 Fix available 7.5 HighOctober 7, 2026
• io.root.org.asynchttpclient:async-http-client Root AsyncHttpClient: Unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of service CVE-2026-85721 Public exploitFix available 7.5 HighSeptember 17, 2026
• io.root.org.asynchttpclient:async-http-client Root async-http-client: Cookie header not stripped on cross-origin redirect CVE-2026-45300 Fix available 7.4 HighMay 18, 2026