# cve.now: Asynchttpclient

The newest entries naming Asynchttpclient as an affected vendor (up to 200), of 25 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-102740](https://cve.now/CVE-2026-102740.md): AsyncHttpClient: Resumable download index store is created world-readable and follows a planted symlink (CVSS 5.8)
- [CVE-2026-107226](https://cve.now/CVE-2026-107226.md): AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPS (CVSS 6.8)
- [CVE-2026-107285](https://cve.now/CVE-2026-107285.md): AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel (CVSS 5.9)
- [CVE-2026-107284](https://cve.now/CVE-2026-107284.md): AsyncHttpClient: WebSocket handshake continues after a failed Sec-WebSocket-Accept check (CVSS 3.7)
- [CVE-2026-107283](https://cve.now/CVE-2026-107283.md): AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random source (CVSS 3.7)
- [CVE-2026-107282](https://cve.now/CVE-2026-107282.md): AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host (CVSS 9.4)
- [CVE-2026-107281](https://cve.now/CVE-2026-107281.md): AsyncHttpClient: Connection pool key omits the authenticated principal, so an NTLM or Negotiate connection is reused across identities (CVSS 7.6)
- [CVE-2026-107280](https://cve.now/CVE-2026-107280.md): AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.uk (CVSS 6.9)
- [CVE-2026-107279](https://cve.now/CVE-2026-107279.md): AsyncHttpClient: Digest mutual authentication is switched off by a peer offering qop=auth-int (CVSS 8.8)
- [CVE-2026-107232](https://cve.now/CVE-2026-107232.md): AsyncHttpClient: Origin credentials sent in cleartext to a proxy that rejects the CONNECT (CVSS 7.5)
- [CVE-2026-107231](https://cve.now/CVE-2026-107231.md): AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext (CVSS 8.7)
- [CVE-2026-107230](https://cve.now/CVE-2026-107230.md): AsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy logins (CVSS 7.4)
- [CVE-2026-107229](https://cve.now/CVE-2026-107229.md): AsyncHttpClient: Incomplete origin checks in the default cookie store allow cookie tossing onto public-suffix and IP-address hosts (CVSS 4.0)
- [CVE-2026-107228](https://cve.now/CVE-2026-107228.md): AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader (Bypass of CVE-2024-53990 Fix) (CVSS 6.8)
- [CVE-2026-107227](https://cve.now/CVE-2026-107227.md): AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabled (CVSS 7.5)
- [CVE-2026-85716](https://cve.now/CVE-2026-85716.md): AsyncHttpClient: SCRAM and Digest mutual-authentication responses are not verified (CVSS 3.7)
- [CVE-2026-85720](https://cve.now/CVE-2026-85720.md): AsyncHttpClient: Origin credentials sent to the proxy on the plaintext CONNECT request (CVSS 5.9)
- [CVE-2026-85718](https://cve.now/CVE-2026-85718.md): AsyncHttpClient: Connection permit leak on TLS handshake failure causes per-host denial of service (CVSS 5.9)
- [CVE-2026-85721](https://cve.now/CVE-2026-85721.md): AsyncHttpClient: Unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of service (CVSS 7.5)
- [CVE-2026-85717](https://cve.now/CVE-2026-85717.md): AsyncHttpClient: Client-wide realm credentials re-sent to a cross-origin redirect target (CVSS 6.8)
- [CVE-2026-85719](https://cve.now/CVE-2026-85719.md): AsyncHttpClient: SOCKS proxy credentials sent to the origin server over plaintext HTTP (CVSS 7.5)
- [CVE-2026-55688](https://cve.now/CVE-2026-55688.md): AsyncHttpClient: Cookie stored for an unrelated domain (cookie tossing) via ThreadSafeCookieStore (CVSS 4.0)
- [CVE-2026-45300](https://cve.now/CVE-2026-45300.md): async-http-client: Cookie header not stripped on cross-origin redirect (CVSS 7.4)
- [CVE-2026-40490](https://cve.now/CVE-2026-40490.md): AsyncHttpClient leaks authorization credentials to untrusted domains on cross-origin redirects (CVSS 6.8)
- [CVE-2024-53990](https://cve.now/CVE-2024-53990.md): AsyncHttpClient (AHC) library's \`CookieStore\` replaces explicitly defined \`Cookie\`s (CVSS 9.2)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/asynchttpclient
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.