Asynchttpclient Async-http-client vulnerabilities

• asynchttpclient async-http-client AsyncHttpClient: Resumable download index store is created world-readable and follows a planted symlink CVE-2026-102740 5.8 MediumOctober 15, 2026
• asynchttpclient async-http-client AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPS CVE-2026-107226 Fix available 6.8 MediumOctober 8, 2026
• asynchttpclient async-http-client AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel CVE-2026-107285 Fix available 5.9 MediumOctober 7, 2026
• asynchttpclient async-http-client AsyncHttpClient: WebSocket handshake continues after a failed Sec-WebSocket-Accept check CVE-2026-107284 3.7 LowOctober 7, 2026
• asynchttpclient async-http-client AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random source CVE-2026-107283 Fix available 3.7 LowOctober 7, 2026
• asynchttpclient async-http-client AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host CVE-2026-107282 Fix available 9.4 CriticalOctober 7, 2026
• asynchttpclient async-http-client AsyncHttpClient: Connection pool key omits the authenticated principal, so an NTLM or Negotiate connection is reused across identities CVE-2026-107281 7.6 HighOctober 7, 2026
• asynchttpclient async-http-client AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.uk CVE-2026-107280 Fix available 6.9 MediumOctober 7, 2026
• asynchttpclient async-http-client AsyncHttpClient: Digest mutual authentication is switched off by a peer offering qop=auth-int CVE-2026-107279 8.8 HighOctober 7, 2026
• asynchttpclient async-http-client AsyncHttpClient: Origin credentials sent in cleartext to a proxy that rejects the CONNECT CVE-2026-107232 7.5 HighOctober 7, 2026
• asynchttpclient async-http-client AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext CVE-2026-107231 Fix available 8.7 HighOctober 7, 2026
• asynchttpclient async-http-client AsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy logins CVE-2026-107230 Fix available 7.4 HighOctober 7, 2026
• asynchttpclient async-http-client AsyncHttpClient: Incomplete origin checks in the default cookie store allow cookie tossing onto public-suffix and IP-address hosts CVE-2026-107229 4.0 MediumOctober 7, 2026
• asynchttpclient async-http-client AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader (Bypass of CVE-2024-53990 Fix) CVE-2026-107228 Fix available 6.8 MediumOctober 7, 2026
• asynchttpclient async-http-client AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabled CVE-2026-107227 Fix available 7.5 HighOctober 7, 2026
• asynchttpclient async-http-client AsyncHttpClient: SCRAM and Digest mutual-authentication responses are not verified CVE-2026-85716 Fix available 3.7 LowSeptember 17, 2026
• asynchttpclient async-http-client AsyncHttpClient: Origin credentials sent to the proxy on the plaintext CONNECT request CVE-2026-85720 Fix available 5.9 MediumSeptember 17, 2026
• asynchttpclient async-http-client AsyncHttpClient: Connection permit leak on TLS handshake failure causes per-host denial of service CVE-2026-85718 5.9 MediumSeptember 17, 2026
• asynchttpclient async-http-client AsyncHttpClient: Unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of service CVE-2026-85721 Public exploitFix available 7.5 HighSeptember 17, 2026
• asynchttpclient async-http-client AsyncHttpClient: Client-wide realm credentials re-sent to a cross-origin redirect target CVE-2026-85717 Fix available 6.8 MediumSeptember 17, 2026
• asynchttpclient async-http-client AsyncHttpClient: SOCKS proxy credentials sent to the origin server over plaintext HTTP CVE-2026-85719 7.5 HighSeptember 17, 2026
• asynchttpclient async-http-client AsyncHttpClient: Cookie stored for an unrelated domain (cookie tossing) via ThreadSafeCookieStore CVE-2026-55688 Fix available 4.0 MediumJuly 1, 2026
• asynchttpclient async-http-client async-http-client: Cookie header not stripped on cross-origin redirect CVE-2026-45300 Fix available 7.4 HighMay 18, 2026
• asynchttpclient async-http-client AsyncHttpClient leaks authorization credentials to untrusted domains on cross-origin redirects CVE-2026-40490 Fix available 6.8 MediumApril 14, 2026
• asynchttpclient async-http-client AsyncHttpClient (AHC) library's `CookieStore` replaces explicitly defined `Cookie`s CVE-2024-53990 Fix available 9.2 CriticalDecember 2, 2024