# org.asynchttpclient:async-http-client (Maven) vulnerabilities 18 known vulnerabilities (2 critical, 5 high, 8 medium, 2 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 3.0.14 (Sep 24, 2026): no advisory affects it - Newest unaffected release: 3.0.14 (Sep 24, 2026), the latest release - Dependents: 50 - Releases: 167 since 2.0.0 (Apr 13, 2016) - Registry: https://central.sonatype.com/artifact/org.asynchttpclient/async-http-client - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-107226: 2.1.0 to 2.16.1 (3.0.0.Beta1 is outside it); 3.0.0 to 3.0.13 (3.0.14 is outside it) - CVE-2026-107285: 2.0.0 to 2.16.0 (2.16.1 is outside it); 3.0.0 to 3.0.11 (3.0.12 is outside it) - CVE-2026-107283: 2.0.0 to 2.16.0 (2.16.1 is outside it); 3.0.0 to 3.0.11 (3.0.12 is outside it) - CVE-2026-107282: 2.0.0 to 2.16.0 (2.16.1 is outside it); 3.0.0 to 3.0.12 (3.0.13 is outside it) - CVE-2026-107280: 2.0.0 to 2.16.0 (2.16.1 is outside it); 3.0.0 to 3.0.12 (3.0.13 is outside it) - CVE-2026-107231: 2.0.0 to 2.16.0 (2.16.1 is outside it); 3.0.0.Beta1 to 3.0.12 (3.0.13 is outside it) - CVE-2026-107230: 2.0.0 to 2.16.1 (3.0.0.Beta1 is outside it); 3.0.0 to 3.0.13 (3.0.14 is outside it) - CVE-2026-107228: 2.1.0 to 2.16.1 (3.0.0.Beta1 is outside it); 3.0.0 to 3.0.13 (3.0.14 is outside it) - CVE-2026-107227: 2.2.0 to 2.16.1 (3.0.0.Beta1 is outside it); 3.0.0 to 3.0.13 (3.0.14 is outside it) - CVE-2026-85716: 3.0.8 to 3.0.11 (3.0.12 is outside it) - CVE-2026-85720: 2.0.0 to 2.16.0 (2.16.1 is outside it); 3.0.0 to 3.0.11 (3.0.12 is outside it) - CVE-2026-85721: 2.0.0 to 2.16.0 (2.16.1 is outside it); 3.0.0 to 3.0.11 (3.0.12 is outside it) - CVE-2026-85717: 2.14.5 to 2.16.0 (2.16.1 is outside it); 3.0.9 to 3.0.11 (3.0.12 is outside it) - CVE-2026-55688: 2.0.0 to 2.15.0 (2.16.0 is outside it); 3.0.0.Beta1 to 3.0.10 (3.0.11 is outside it) - CVE-2026-45300: 2.0.0 to 2.14.5 (2.15.0 is outside it); 3.0.0.Beta1 to 3.0.9 (3.0.10 is outside it) - CVE-2026-40490: 2.0.0 to 2.12.4 (2.14.5 is outside it); 3.0.0.Beta1 to 3.0.8 (3.0.9 is outside it) - CVE-2024-53990: 2.1.0 to 2.12.3 (2.12.4 is outside it); 3.0.0.Beta1 to 3.0.0 (3.0.1 is outside it) - CVE-2017-14063: 2.0.0-alpha13 to 2.0.34 (2.0.35 is outside it) ## Advisories (18) ### [CVE-2026-107226](https://cve.now/CVE-2026-107226): AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPS - Severity: Medium 6.8 - Published: Oct 12, 2026 - Affected: from 3.0.0, fixed in 3.0.14; from 2.1.0, through 2.16.1. - Fixed in 3.0.14 (released Sep 24, 2026, 18 days before disclosure). - The latest release, 3.0.14, is not affected. ### [CVE-2026-107285](https://cve.now/CVE-2026-107285): AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel - Severity: Medium 5.9 - Published: Oct 7, 2026 - Affected: from 3.0.0, fixed in 3.0.12; from 2.0.0, fixed in 2.16.1. - Fixed in 2.16.1 (released Aug 9, 2026, 59 days before disclosure) and 3.0.12 (released Aug 9, 2026, 59 days before disclosure). - The latest release, 3.0.14, is not affected. ### [CVE-2026-107283](https://cve.now/CVE-2026-107283): AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random source - Severity: Low 3.7 - Published: Oct 7, 2026 - Affected: from 3.0.0, fixed in 3.0.12; from 2.0.0, fixed in 2.16.1. - Fixed in 2.16.1 (released Aug 9, 2026, 59 days before disclosure) and 3.0.12 (released Aug 9, 2026, 59 days before disclosure). - The latest release, 3.0.14, is not affected. ### [CVE-2026-107282](https://cve.now/CVE-2026-107282): AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host - Severity: Critical 9.4 - Published: Oct 7, 2026 - Affected: from 3.0.0, fixed in 3.0.13; from 2.0.0, fixed in 2.16.1. - Fixed in 2.16.1 (released Aug 9, 2026, 59 days before disclosure) and 3.0.13 (released Aug 9, 2026, 59 days before disclosure). - The latest release, 3.0.14, is not affected. ### [CVE-2026-107280](https://cve.now/CVE-2026-107280): AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.uk - Severity: Medium 6.9 - Published: Oct 7, 2026 - Affected: from 3.0.0, fixed in 3.0.13; from 2.0.0, fixed in 2.16.1. - Fixed in 2.16.1 (released Aug 9, 2026, 59 days before disclosure) and 3.0.13 (released Aug 9, 2026, 59 days before disclosure). - The latest release, 3.0.14, is not affected. ### [CVE-2026-107231](https://cve.now/CVE-2026-107231): AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext - Severity: High 8.7 - Published: Oct 7, 2026 - Affected: from 3.0.0.Beta1, fixed in 3.0.13; from 2.0.0, fixed in 2.16.1. - Fixed in 2.16.1 (released Aug 9, 2026, 59 days before disclosure) and 3.0.13 (released Aug 9, 2026, 59 days before disclosure). - The latest release, 3.0.14, is not affected. ### [CVE-2026-107230](https://cve.now/CVE-2026-107230): AsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy logins - Severity: High 7.4 - Published: Oct 7, 2026 - Affected: from 3.0.0, fixed in 3.0.14; from 2.0.0, through 2.16.1. - Fixed in 3.0.14 (released Sep 24, 2026, 13 days before disclosure). - The latest release, 3.0.14, is not affected. ### [CVE-2026-107228](https://cve.now/CVE-2026-107228): AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader (Bypass of CVE-2024-53990 Fix) - Severity: Medium 6.8 - Published: Oct 7, 2026 - Affected: from 3.0.0, fixed in 3.0.14; from 2.1.0, through 2.16.1. - Fixed in 3.0.14 (released Sep 24, 2026, 13 days before disclosure). - The latest release, 3.0.14, is not affected. ### [CVE-2026-107227](https://cve.now/CVE-2026-107227): AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabled - Severity: High 7.5 - Published: Oct 7, 2026 - Affected: from 3.0.0, fixed in 3.0.14; from 2.2.0, through 2.16.1. - Fixed in 3.0.14 (released Sep 24, 2026, 13 days before disclosure). - The latest release, 3.0.14, is not affected. ### [CVE-2026-85716](https://cve.now/CVE-2026-85716): AsyncHttpClient: SCRAM and Digest mutual-authentication responses are not verified - Severity: Low 3.7 - Published: Sep 17, 2026 - Affected: from 3.0.8, fixed in 3.0.12. - Fixed in 3.0.12 (released Aug 9, 2026, 39 days before disclosure). - The latest release, 3.0.14, is not affected. ### [CVE-2026-85720](https://cve.now/CVE-2026-85720): AsyncHttpClient: Origin credentials sent to the proxy on the plaintext CONNECT request - Severity: Medium 5.9 - Published: Sep 17, 2026 - Affected: from 3.0.0, fixed in 3.0.12; from 2.0.0, fixed in 2.16.1. - Fixed in 2.16.1 (released Aug 9, 2026, 39 days before disclosure) and 3.0.12 (released Aug 9, 2026, 39 days before disclosure). - The latest release, 3.0.14, is not affected. ### [CVE-2026-85721](https://cve.now/CVE-2026-85721): AsyncHttpClient: Unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of service - Severity: High 7.5 - Published: Sep 17, 2026 - Affected: from 3.0.0, fixed in 3.0.12; from 2.0.0, fixed in 2.16.1. - Fixed in 2.16.1 (released Aug 9, 2026, 39 days before disclosure) and 3.0.12 (released Aug 9, 2026, 39 days before disclosure). - The latest release, 3.0.14, is not affected. ### [CVE-2026-85717](https://cve.now/CVE-2026-85717): AsyncHttpClient: Client-wide realm credentials re-sent to a cross-origin redirect target - Severity: Medium 6.8 - Published: Sep 17, 2026 - Affected: from 3.0.9, fixed in 3.0.12; from 2.14.5, fixed in 2.16.1. - Fixed in 2.16.1 (released Aug 9, 2026, 39 days before disclosure) and 3.0.12 (released Aug 9, 2026, 39 days before disclosure). - The latest release, 3.0.14, is not affected. ### [CVE-2026-55688](https://cve.now/CVE-2026-55688): AsyncHttpClient: Cookie stored for an unrelated domain (cookie tossing) via ThreadSafeCookieStore - Severity: Medium 4.0 - Published: Jul 1, 2026 - Affected: from 3.0.0.Beta1, fixed in 3.0.11; from 2.0.0, fixed in 2.16.0. - Fixed in 2.16.0 (released Jun 15, 2026, 16 days before disclosure) and 3.0.11 (released Jun 14, 2026, 17 days before disclosure). - The latest release, 3.0.14, is not affected. ### [CVE-2026-45300](https://cve.now/CVE-2026-45300): async-http-client: Cookie header not stripped on cross-origin redirect - Severity: High 7.4 - Published: Jun 5, 2026 - Affected: from 3.0.0.Beta1, fixed in 3.0.10; from 2.0.0, fixed in 2.15.0. - Fixed in 2.15.0 (released May 12, 2026, 24 days before disclosure) and 3.0.10 (released May 12, 2026, 24 days before disclosure). - The latest release, 3.0.14, is not affected. ### [CVE-2026-40490](https://cve.now/CVE-2026-40490): AsyncHttpClient leaks authorization credentials to untrusted domains on cross-origin redirects - Severity: Medium 6.8 - Published: Apr 18, 2026 - Affected: from 3.0.0.Beta1, fixed in 3.0.9; from 2.0.0, fixed in 2.14.5. - Fixed in 2.14.5 (released Apr 16, 2026, 2 days before disclosure) and 3.0.9 (released Apr 12, 2026, 6 days before disclosure). - The latest release, 3.0.14, is not affected. ### [CVE-2024-53990](https://cve.now/CVE-2024-53990): AsyncHttpClient (AHC) library's \`CookieStore\` replaces explicitly defined \`Cookie\`s - Severity: Critical 9.2 - Published: Dec 2, 2024 - Affected: from 2.1.0, fixed in 2.12.4; from 3.0.0.Beta1, fixed in 3.0.1. - Fixed in 2.12.4 (released Dec 15, 2024, 13 days after disclosure) and 3.0.1 (released Dec 2, 2024, the day of disclosure). - The latest release, 3.0.14, is not affected. ### [CVE-2017-14063](https://cve.now/CVE-2017-14063): Async Http Client (aka async-http-client) before 2.0.35 can be tricked into connecting to a host different from the one extracted by… - Severity: Unrated - Published: Aug 31, 2017 - Affected: fixed in 2.0.35. - Fixed in 2.0.35 (released Aug 28, 2017, 3 days before disclosure). - The latest release, 3.0.14, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/maven/org.asynchttpclient:async-http-client Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.