Asynchttpclient vulnerabilities
25 CVEs and advisories name Asynchttpclient as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-102740AsyncHttpClient: Resumable download index store is created world-readable and follows a planted symlink
- CVE-2026-107226AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPS
- CVE-2026-107285AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel
- CVE-2026-107284AsyncHttpClient: WebSocket handshake continues after a failed Sec-WebSocket-Accept check
- CVE-2026-107283AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random source
- CVE-2026-107282AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host
- CVE-2026-107281AsyncHttpClient: Connection pool key omits the authenticated principal, so an NTLM or Negotiate connection is reused across identities
- CVE-2026-107280AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.uk
- CVE-2026-107279AsyncHttpClient: Digest mutual authentication is switched off by a peer offering qop=auth-int
- CVE-2026-107232AsyncHttpClient: Origin credentials sent in cleartext to a proxy that rejects the CONNECT
- CVE-2026-107231AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext
- CVE-2026-107230AsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy logins
- CVE-2026-107229AsyncHttpClient: Incomplete origin checks in the default cookie store allow cookie tossing onto public-suffix and IP-address hosts
- CVE-2026-107228AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader (Bypass of CVE-2024-53990 Fix)
- CVE-2026-107227AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabled
- CVE-2026-85716AsyncHttpClient: SCRAM and Digest mutual-authentication responses are not verified
- CVE-2026-85720AsyncHttpClient: Origin credentials sent to the proxy on the plaintext CONNECT request
- CVE-2026-85718AsyncHttpClient: Connection permit leak on TLS handshake failure causes per-host denial of service
- CVE-2026-85721AsyncHttpClient: Unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of service
- CVE-2026-85717AsyncHttpClient: Client-wide realm credentials re-sent to a cross-origin redirect target
- CVE-2026-85719AsyncHttpClient: SOCKS proxy credentials sent to the origin server over plaintext HTTP
- CVE-2026-55688AsyncHttpClient: Cookie stored for an unrelated domain (cookie tossing) via ThreadSafeCookieStore
- CVE-2026-45300async-http-client: Cookie header not stripped on cross-origin redirect
- CVE-2026-40490AsyncHttpClient leaks authorization credentials to untrusted domains on cross-origin redirects
- CVE-2024-53990AsyncHttpClient (AHC) library's `CookieStore` replaces explicitly defined `Cookie`s