[ Vendor · 15 CVEs ]
AsyncHttpClient
CVEs affecting AsyncHttpClient published in the last 30 days, plus any AsyncHttpClient CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-102740 | 15 Oct 2026 | CVSS 5.8 | AsyncHttpClient async-http-clientThe AsyncHttpClient library allows Java applications to execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 and… | |
| CVE-2026-107226 | 12 Oct 2026 | CVSS 6.8 | AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPSThe AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0… | Fix |
| CVE-2026-107282 | 7 Oct 2026 | CVSS 9.4 | AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new hostThe AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13… | Fix |
| CVE-2026-107283 | 7 Oct 2026 | CVSS 3.7 | AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random sourceThe AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12… | Fix |
| CVE-2026-107284 | 7 Oct 2026 | CVSS 3.7 | AsyncHttpClient async-http-clientThe AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12… | |
| CVE-2026-107285 | 7 Oct 2026 | CVSS 5.9 | AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnelThe AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12… | Fix |
| CVE-2026-107230 | 7 Oct 2026 | CVSS 7.4 | AsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy loginsThe AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.0.0… | Fix |
| CVE-2026-107231 | 7 Oct 2026 | CVSS 8.7 | AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartextThe AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13… | Fix |
| CVE-2026-107232 | 7 Oct 2026 | CVSS 7.5 | AsyncHttpClient async-http-clientThe AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12… | |
| CVE-2026-107279 | 7 Oct 2026 | CVSS 8.8 | AsyncHttpClient async-http-clientThe AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. In 3.0.12, a… | |
| CVE-2026-107280 | 7 Oct 2026 | CVSS 6.9 | AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.ukThe AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13… | Fix |
| CVE-2026-107281 | 7 Oct 2026 | CVSS 7.6 | AsyncHttpClient async-http-clientThe AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13… | |
| CVE-2026-107227 | 7 Oct 2026 | CVSS 7.5 | AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabledThe AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.2.0… | Fix |
| CVE-2026-107228 | 7 Oct 2026 | CVSS 6.8 | AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader (Bypass of CVE-2024-53990 Fix)The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0… | Fix |
| CVE-2026-107229 | 7 Oct 2026 | CVSS 4.0 | AsyncHttpClient async-http-clientThe AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.16.0… |