Skip to content
Asynchttpclient vulnerabilities
Newest
-
asynchttpclient async-http-client
AsyncHttpClient: Resumable download index store is created world-readable and follows a planted symlink
CVE-2026-102740
5.8 Medium
-
asynchttpclient async-http-client
AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPS
CVE-2026-107226
Fix available
6.8 Medium
-
asynchttpclient async-http-client
AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel
CVE-2026-107285
Fix available
5.9 Medium
-
asynchttpclient async-http-client
AsyncHttpClient: WebSocket handshake continues after a failed Sec-WebSocket-Accept check
CVE-2026-107284
3.7 Low
-
asynchttpclient async-http-client
AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random source
CVE-2026-107283
Fix available
3.7 Low
-
asynchttpclient async-http-client
AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host
CVE-2026-107282
Fix available
9.4 Critical
-
asynchttpclient async-http-client
AsyncHttpClient: Connection pool key omits the authenticated principal, so an NTLM or Negotiate connection is reused across identities
CVE-2026-107281
7.6 High
-
asynchttpclient async-http-client
AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.uk
CVE-2026-107280
Fix available
6.9 Medium
-
asynchttpclient async-http-client
AsyncHttpClient: Digest mutual authentication is switched off by a peer offering qop=auth-int
CVE-2026-107279
8.8 High
-
asynchttpclient async-http-client
AsyncHttpClient: Origin credentials sent in cleartext to a proxy that rejects the CONNECT
CVE-2026-107232
7.5 High
-
asynchttpclient async-http-client
AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext
CVE-2026-107231
Fix available
8.7 High
-
asynchttpclient async-http-client
AsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy logins
CVE-2026-107230
Fix available
7.4 High
-
asynchttpclient async-http-client
AsyncHttpClient: Incomplete origin checks in the default cookie store allow cookie tossing onto public-suffix and IP-address hosts
CVE-2026-107229
4.0 Medium
-
asynchttpclient async-http-client
AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader (Bypass of CVE-2024-53990 Fix)
CVE-2026-107228
Fix available
6.8 Medium
-
asynchttpclient async-http-client
AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabled
CVE-2026-107227
Fix available
7.5 High
-
asynchttpclient async-http-client
AsyncHttpClient: SCRAM and Digest mutual-authentication responses are not verified
CVE-2026-85716
Fix available
3.7 Low
-
asynchttpclient async-http-client
AsyncHttpClient: Origin credentials sent to the proxy on the plaintext CONNECT request
CVE-2026-85720
Fix available
5.9 Medium
-
asynchttpclient async-http-client
AsyncHttpClient: Connection permit leak on TLS handshake failure causes per-host denial of service
CVE-2026-85718
5.9 Medium
-
asynchttpclient async-http-client
AsyncHttpClient: Unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of service
CVE-2026-85721
Public exploitFix available
7.5 High
-
asynchttpclient async-http-client
AsyncHttpClient: Client-wide realm credentials re-sent to a cross-origin redirect target
CVE-2026-85717
Fix available
6.8 Medium
-
asynchttpclient async-http-client
AsyncHttpClient: SOCKS proxy credentials sent to the origin server over plaintext HTTP
CVE-2026-85719
7.5 High
-
asynchttpclient async-http-client
AsyncHttpClient: Cookie stored for an unrelated domain (cookie tossing) via ThreadSafeCookieStore
CVE-2026-55688
Fix available
4.0 Medium
-
asynchttpclient async-http-client
async-http-client: Cookie header not stripped on cross-origin redirect
CVE-2026-45300
Fix available
7.4 High
-
asynchttpclient async-http-client
AsyncHttpClient leaks authorization credentials to untrusted domains on cross-origin redirects
CVE-2026-40490
Fix available
6.8 Medium
-
asynchttpclient async-http-client
AsyncHttpClient (AHC) library's `CookieStore` replaces explicitly defined `Cookie`s
CVE-2024-53990
Fix available
9.2 Critical