CVE-2026-102740: CWE-61: UNIX Symbolic Link (Symlink) Following in AsyncHttpClient async-http-client

The AsyncHttpClient library versions >=2.0.0 <2.16.1 and >=3.0.0 <3.0.12 use PropertiesBasedResumableProcessor to store resumable download state in a predictable file path ($java.io.tmpdir/ahc/ResumableAsyncHandler.properties) with default permissions and follow symbolic links during file operations. A local user who can write to or pre-create the shared store directory can plant a symbolic link that the client follows, causing truncation and overwriting of arbitrary files writable by the client process. This can expose download URLs containing sensitive information and enable local file overwrite attacks. The issue does not affect no-argument constructors that use a no-op processor. The vulnerability is resolved in versions 2.16.1 and 3.0.12.

Local users with write access to the shared directory can exploit this vulnerability to overwrite arbitrary files writable by the client process, potentially leading to integrity loss and exposure of sensitive download URLs containing user information or tokens. The vulnerability requires local access and elevated privileges to write to the shared directory. The CVSS 3.1 score is 5.8 (medium), reflecting low attack vector (local), high complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

Upgrade AsyncHttpClient to version 2.16.1 or later, or 3.0.12 or later, where this vulnerability is fixed. Until then, restrict write permissions to the shared resumable download state directory ($java.io.tmpdir/ahc) to trusted users only to prevent symbolic link attacks. Note that no-argument constructors using a no-op processor are not affected.