CVE-2026-107231 · GHSA-rqf5-2wxv-rjf4
AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext
- Risk score
- 65/100
- CVSS
- 8.7 v4.0
- Exploit chance (30 days)
- 0.2%
- Published
- 7 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, Realm.Builder treats a Digest challenge that yields no usable nonce as a Basic challenge. A malicious origin or proxy can label a challenge Digest while omit…
- Affected
- org.asynchttpclient:async-http-client (maven) >= 3.0.0.Beta1, <= 3.0.12; org.asynchttpclient:async-http-client (maven) >= 2.0.0, <= 2.16.0
- Fix
- Upgrade org.asynchttpclient:async-http-client to 3.0.13 or 2.16.1 (whichever matches your release line) or later.
- Exploitation
- No known exploitation
Story map
At a glance
org.asynchttpclient:async-http-client: Amber, patch this week. The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, cross-host request replay updates the current request but leaves the target request and related proxy context pointing at the original origin. Connection-poo…
The flaws
- CVE-2026-107231: AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext (CVSS 8.7 · EPSS 0%)
- CVE-2026-107282: AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host (CVSS 9.4 · EPSS 0%)
- CVE-2026-107227: AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabled (CVSS 7.5 · EPSS 0%)
- CVE-2026-107230: AsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy logins (CVSS 7.4 · EPSS 0%)
The fix
Upgrade org.asynchttpclient:async-http-client: 3.0.13 · 2.16.1 · 3.0.14 or later on your release line
Who is exposed: org.asynchttpclient:async-http-client (maven) >= 3.0.0, <= 3.0.12; org.asynchttpclient:async-http-client (maven) >= 2.0.0, <= 2.16.0
Where it stands
- No known exploitation
Connects to
- Same weakness: CWE-319 (CWE-319). 15 other warnings in 30 days
Why it is Amber
- CVSS 8.7 high
- Remotely exploitable without logging in
- On your watchlist: Maven
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| org.asynchttpclient:async-http-client | maven | >= 3.0.0.Beta1, <= 3.0.12 | 3.0.13 |
| org.asynchttpclient:async-http-client | maven | >= 2.0.0, <= 2.16.0 | 2.16.1 |
References
- https://github.com/advisories/GHSA-rqf5-2wxv-rjf4
- https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-rqf5-2wxv-rjf4
- https://nvd.nist.gov/vuln/detail/CVE-2026-107231
- https://github.com/AsyncHttpClient/async-http-client/commit/8376866aa9b5a7653ad19db9d472692f875caa83
- https://github.com/AsyncHttpClient/async-http-client/commit/c8d639bf6ac341d377d610a93570bcd15565f1a6
- https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-2.16.1
- https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.13
- https://github.com/advisories/GHSA-rqf5-2wxv-rjf4
Original description
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, Realm.Builder treats a Digest challenge that yields no usable nonce as a Basic challenge. A malicious origin or proxy can label a challenge Digest while omitting or emptying the nonce, causing the client to resend the username and password using reversible Basic authentication. Both origin and proxy challenge parsers are affected. This issue is fixed in versions 3.0.13 and 2.16.1.
Last activity 7 Oct 2026. Patch Forecast updates every hour.