CVE-2026-107230: CWE-346: Origin Validation Error in AsyncHttpClient async-http-client
Description
AsyncHttpClient versions from 2.0.0 up to but not including 3.0.14 have an origin validation error related to connection-pool partitioning. This flaw allows reuse of sockets authenticated as different identities in certain authentication scenarios (Kerberos, SPNEGO, NTLM, authenticated proxies). As a result, a later request may execute under a previous identity, potentially exposing sensitive data or authority. The issue is fixed in version 3.0.14.
CVSS v3.1
Score 7.4high
Affected software
AsyncHttpClient
async-http-client
pkg:maven/org.asynchttpclient/async-http-clientRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The AsyncHttpClient library versions >=2.0.0 <=2.16.1 and >=3.0.0 <3.0.14 suffer from a connection-pool partitioning flaw that omits identity-defining fields for Kerberos, SPNEGO, NTLM, and authenticated proxy connections. This omission allows socket reuse across different authenticated identities when logins lack configured principals or share usernames, or when using SOCKS or CONNECT proxy logins. Consequently, requests may be executed under an unintended identity, exposing that identity's data or authority. The vulnerable components include SpnegoEngine, NTLM, Kerberos, SPNEGO, SOCKS, and CONNECT. The vulnerability is addressed in version 3.0.14.
Potential Impact
An attacker or caller can cause a request to be executed under a previously authenticated identity due to improper connection-pool partitioning. This can lead to unauthorized exposure of sensitive data or authority associated with that identity. The CVSS score of 7.4 (high) reflects the network attack vector, high confidentiality and integrity impact, and no required privileges or user interaction.
Mitigation Recommendations
Upgrade AsyncHttpClient to version 3.0.14 or later, where this origin validation error and connection-pool partitioning issue is fixed. No other mitigation is indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-10-07T14:34:14.817Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ac6bac72cdf04f65680ca5c
Added to database: 10/07/2026, 21:33:59 UTC
Last enriched: 10/07/2026, 21:48:35 UTC
Last updated: 10/07/2026, 21:49:05 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.