CVE-2026-107279
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and…
- Risk score
- 64/100
- CVSS
- 8.8 v4.0
- Exploit chance (30 days)
- 0.4%
- Published
- 7 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. In 3.0.12, a peer offering only Digest qop=auth-int causes mutual-authentication verification to be skipped. AuthenticatorUtils.computeExpectedRspAuth returns no expected value for auth…
- Affected
- See advisory
- Fix
- Upgrade the product to 3.0.13 or later.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 8.8 high
- Remotely exploitable without logging in
References
Original description
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. In 3.0.12, a peer offering only Digest qop=auth-int causes mutual-authentication verification to be skipped. AuthenticatorUtils.computeExpectedRspAuth returns no expected value for auth-int, and Interceptors treats that result as unverifiable but nonfatal, so a response with an invalid rspauth value is accepted. A peer that does not know the shared secret can therefore be accepted as the authenticated server. This issue is fixed in version 3.0.13.
Last activity 7 Oct 2026. Patch Forecast updates every hour.