AsyncHttpClient vulnerabilities

CVEs per yearBy the year they were published

1. 20241
2. 202624

Newest CVEs

• CVE-2026-102740

  AsyncHttpClient: Resumable download index store is created world-readable and follows a planted symlink

  AsyncHttpClient · async-http-client

  Medium5.8
• CVE-2026-107226

  AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPS

  AsyncHttpClient · async-http-client

  Medium6.8
• CVE-2026-107285

  AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel

  AsyncHttpClient · async-http-client

  Medium5.9
• CVE-2026-107284

  AsyncHttpClient: WebSocket handshake continues after a failed Sec-WebSocket-Accept check

  AsyncHttpClient · async-http-client

  Low3.7
• CVE-2026-107283

  AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random source

  AsyncHttpClient · async-http-client

  Low3.7
• CVE-2026-107282

  AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host

  AsyncHttpClient · async-http-client

  Critical9.4
• CVE-2026-107281

  AsyncHttpClient: Connection pool key omits the authenticated principal, so an NTLM or Negotiate connection is reused across identities

  AsyncHttpClient · async-http-client

  High7.6
• CVE-2026-107280

  AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.uk

  AsyncHttpClient · async-http-client

  Medium6.9
• CVE-2026-107279

  AsyncHttpClient: Digest mutual authentication is switched off by a peer offering qop=auth-int

  AsyncHttpClient · async-http-client

  High8.8
• CVE-2026-107232

  AsyncHttpClient: Origin credentials sent in cleartext to a proxy that rejects the CONNECT

  AsyncHttpClient · async-http-client

  High7.5