MavenPackage

org.asynchttpclient:async-http-client

18 known vulnerabilities (2 critical, 5 high, 8 medium, 2 low), with the versions each affects and the releases that fix them.

Latest release: 3.0.14 (Sep 24, 2026): no advisory affects it
Newest unaffected release: 3.0.14 (Sep 24, 2026), the latest release
Advisories: 18 · 2 critical, 5 high, 8 medium, 2 low

Dependents: 50
Releases: 167 since 2.0.0 (Apr 13, 2016)
Registry: Maven Central
Releases read: Nov 8, 2026

Version timeline

CVE-2026-107226
Affects 2.1.0 to 2.16.1 (3.0.0.Beta1 is outside it); 3.0.0 to 3.0.13 (3.0.14 is outside it)
CVE-2026-107285
Affects 2.0.0 to 2.16.0 (2.16.1 is outside it); 3.0.0 to 3.0.11 (3.0.12 is outside it)
CVE-2026-107283
Affects 2.0.0 to 2.16.0 (2.16.1 is outside it); 3.0.0 to 3.0.11 (3.0.12 is outside it)
CVE-2026-107282
Affects 2.0.0 to 2.16.0 (2.16.1 is outside it); 3.0.0 to 3.0.12 (3.0.13 is outside it)
CVE-2026-107280
Affects 2.0.0 to 2.16.0 (2.16.1 is outside it); 3.0.0 to 3.0.12 (3.0.13 is outside it)
CVE-2026-107231
Affects 2.0.0 to 2.16.0 (2.16.1 is outside it); 3.0.0.Beta1 to 3.0.12 (3.0.13 is outside it)
CVE-2026-107230
Affects 2.0.0 to 2.16.1 (3.0.0.Beta1 is outside it); 3.0.0 to 3.0.13 (3.0.14 is outside it)
CVE-2026-107228
Affects 2.1.0 to 2.16.1 (3.0.0.Beta1 is outside it); 3.0.0 to 3.0.13 (3.0.14 is outside it)
CVE-2026-107227
Affects 2.2.0 to 2.16.1 (3.0.0.Beta1 is outside it); 3.0.0 to 3.0.13 (3.0.14 is outside it)
CVE-2026-85716
Affects 3.0.8 to 3.0.11 (3.0.12 is outside it)
CVE-2026-85720
Affects 2.0.0 to 2.16.0 (2.16.1 is outside it); 3.0.0 to 3.0.11 (3.0.12 is outside it)
CVE-2026-85721
Affects 2.0.0 to 2.16.0 (2.16.1 is outside it); 3.0.0 to 3.0.11 (3.0.12 is outside it)

Show all 18 advisoriesShow fewer advisories

CVE-2026-85717
Affects 2.14.5 to 2.16.0 (2.16.1 is outside it); 3.0.9 to 3.0.11 (3.0.12 is outside it)
CVE-2026-55688
Affects 2.0.0 to 2.15.0 (2.16.0 is outside it); 3.0.0.Beta1 to 3.0.10 (3.0.11 is outside it)
CVE-2026-45300
Affects 2.0.0 to 2.14.5 (2.15.0 is outside it); 3.0.0.Beta1 to 3.0.9 (3.0.10 is outside it)
CVE-2026-40490
Affects 2.0.0 to 2.12.4 (2.14.5 is outside it); 3.0.0.Beta1 to 3.0.8 (3.0.9 is outside it)
CVE-2024-53990
Affects 2.1.0 to 2.12.3 (2.12.4 is outside it); 3.0.0.Beta1 to 3.0.0 (3.0.1 is outside it)
CVE-2017-14063
Affects 2.0.0-alpha13 to 2.0.34 (2.0.35 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 18

CVE-2026-107226Medium 6.8
AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPS
Affected: from 3.0.0, fixed in 3.0.14; from 2.1.0, through 2.16.1.
Fixed in 3.0.14 (released Sep 24, 2026, 18 days before disclosure).
The latest release, 3.0.14, is not affected.
CVE-2026-107285Medium 5.9
AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel
Affected: from 3.0.0, fixed in 3.0.12; from 2.0.0, fixed in 2.16.1.
Fixed in 2.16.1 (released Aug 9, 2026, 59 days before disclosure) and 3.0.12 (released Aug 9, 2026, 59 days before disclosure).
The latest release, 3.0.14, is not affected.
CVE-2026-107283Low 3.7
AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random source
Affected: from 3.0.0, fixed in 3.0.12; from 2.0.0, fixed in 2.16.1.
Fixed in 2.16.1 (released Aug 9, 2026, 59 days before disclosure) and 3.0.12 (released Aug 9, 2026, 59 days before disclosure).
The latest release, 3.0.14, is not affected.
CVE-2026-107282Critical 9.4
AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host
Affected: from 3.0.0, fixed in 3.0.13; from 2.0.0, fixed in 2.16.1.
Fixed in 2.16.1 (released Aug 9, 2026, 59 days before disclosure) and 3.0.13 (released Aug 9, 2026, 59 days before disclosure).
The latest release, 3.0.14, is not affected.
CVE-2026-107280Medium 6.9
AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.uk
Affected: from 3.0.0, fixed in 3.0.13; from 2.0.0, fixed in 2.16.1.
Fixed in 2.16.1 (released Aug 9, 2026, 59 days before disclosure) and 3.0.13 (released Aug 9, 2026, 59 days before disclosure).
The latest release, 3.0.14, is not affected.
CVE-2026-107231High 8.7
AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext
Affected: from 3.0.0.Beta1, fixed in 3.0.13; from 2.0.0, fixed in 2.16.1.
Fixed in 2.16.1 (released Aug 9, 2026, 59 days before disclosure) and 3.0.13 (released Aug 9, 2026, 59 days before disclosure).
The latest release, 3.0.14, is not affected.
CVE-2026-107230High 7.4
AsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy logins
Affected: from 3.0.0, fixed in 3.0.14; from 2.0.0, through 2.16.1.
Fixed in 3.0.14 (released Sep 24, 2026, 13 days before disclosure).
The latest release, 3.0.14, is not affected.
CVE-2026-107228Medium 6.8
AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader (Bypass of CVE-2024-53990 Fix)
Affected: from 3.0.0, fixed in 3.0.14; from 2.1.0, through 2.16.1.
Fixed in 3.0.14 (released Sep 24, 2026, 13 days before disclosure).
The latest release, 3.0.14, is not affected.
CVE-2026-107227High 7.5
AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabled
Affected: from 3.0.0, fixed in 3.0.14; from 2.2.0, through 2.16.1.
Fixed in 3.0.14 (released Sep 24, 2026, 13 days before disclosure).
The latest release, 3.0.14, is not affected.
CVE-2026-85716Low 3.7
AsyncHttpClient: SCRAM and Digest mutual-authentication responses are not verified
Affected: from 3.0.8, fixed in 3.0.12.
Fixed in 3.0.12 (released Aug 9, 2026, 39 days before disclosure).
The latest release, 3.0.14, is not affected.
CVE-2026-85720Medium 5.9
AsyncHttpClient: Origin credentials sent to the proxy on the plaintext CONNECT request
Affected: from 3.0.0, fixed in 3.0.12; from 2.0.0, fixed in 2.16.1.
Fixed in 2.16.1 (released Aug 9, 2026, 39 days before disclosure) and 3.0.12 (released Aug 9, 2026, 39 days before disclosure).
The latest release, 3.0.14, is not affected.
CVE-2026-85721High 7.5
AsyncHttpClient: Unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of service
Affected: from 3.0.0, fixed in 3.0.12; from 2.0.0, fixed in 2.16.1.
Fixed in 2.16.1 (released Aug 9, 2026, 39 days before disclosure) and 3.0.12 (released Aug 9, 2026, 39 days before disclosure).
The latest release, 3.0.14, is not affected.
CVE-2026-85717Medium 6.8
AsyncHttpClient: Client-wide realm credentials re-sent to a cross-origin redirect target
Affected: from 3.0.9, fixed in 3.0.12; from 2.14.5, fixed in 2.16.1.
Fixed in 2.16.1 (released Aug 9, 2026, 39 days before disclosure) and 3.0.12 (released Aug 9, 2026, 39 days before disclosure).
The latest release, 3.0.14, is not affected.
CVE-2026-55688Medium 4.0
AsyncHttpClient: Cookie stored for an unrelated domain (cookie tossing) via ThreadSafeCookieStore
Affected: from 3.0.0.Beta1, fixed in 3.0.11; from 2.0.0, fixed in 2.16.0.
Fixed in 2.16.0 (released Jun 15, 2026, 16 days before disclosure) and 3.0.11 (released Jun 14, 2026, 17 days before disclosure).
The latest release, 3.0.14, is not affected.
CVE-2026-45300High 7.4
async-http-client: Cookie header not stripped on cross-origin redirect
Affected: from 3.0.0.Beta1, fixed in 3.0.10; from 2.0.0, fixed in 2.15.0.
Fixed in 2.15.0 (released May 12, 2026, 24 days before disclosure) and 3.0.10 (released May 12, 2026, 24 days before disclosure).
The latest release, 3.0.14, is not affected.

Show all 18 advisoriesShow fewer advisories

CVE-2026-40490Medium 6.8
AsyncHttpClient leaks authorization credentials to untrusted domains on cross-origin redirects
Affected: from 3.0.0.Beta1, fixed in 3.0.9; from 2.0.0, fixed in 2.14.5.
Fixed in 2.14.5 (released Apr 16, 2026, 2 days before disclosure) and 3.0.9 (released Apr 12, 2026, 6 days before disclosure).
The latest release, 3.0.14, is not affected.
CVE-2024-53990Critical 9.2
AsyncHttpClient (AHC) library's `CookieStore` replaces explicitly defined `Cookie`s
Affected: from 2.1.0, fixed in 2.12.4; from 3.0.0.Beta1, fixed in 3.0.1.
Fixed in 2.12.4 (released Dec 15, 2024, 13 days after disclosure) and 3.0.1 (released Dec 2, 2024, the day of disclosure).
The latest release, 3.0.14, is not affected.
CVE-2017-14063Unrated
Async Http Client (aka async-http-client) before 2.0.35 can be tricked into connecting to a host different from the one extracted by…
Affected: fixed in 2.0.35.
Fixed in 2.0.35 (released Aug 28, 2017, 3 days before disclosure).
The latest release, 3.0.14, is not affected.