CVE-2026-107282: CWE-319: Cleartext Transmission of Sensitive Information in AsyncHttpClient async-http-client
Description
CVE-2026-107282 is a critical vulnerability in the AsyncHttpClient (AHC) Java library that allows cleartext transmission of sensitive information. Versions prior to 3.0.13 and 2.16.1 are affected. The flaw occurs when cross-host request replay updates the current request but leaves the target request and proxy context pointing to the original host, causing sensitive data such as Host headers, Authorization credentials, and plaintext requests to be sent to unintended destinations. This can happen during documented failover and retry paths. The issue is fixed in versions 3.0.13 and 2.16.1.
CVSS v4.0
Score 9.4critical
Affected software
AsyncHttpClient
async-http-client
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
AsyncHttpClient versions >=2.0.0 <2.16.1 and >=3.0.0 <3.0.13 have a vulnerability where cross-host request replay incorrectly maintains the original host context. This leads to connection-pool selection, CONNECT handling, realm selection, and TLS setup sending sensitive information like the original host's path, Host header, and Authorization credentials in cleartext to the replay destination. The vulnerability is triggered by documented ResponseFilter failover and retry mechanisms. The flaw is addressed in versions 2.16.1 and 3.0.13.
Potential Impact
Sensitive information including Host headers, Authorization credentials, and plaintext requests can be transmitted to unintended hosts during request replay, potentially exposing confidential data. This can lead to information disclosure and compromise of authentication credentials. The vulnerability has a CVSS 4.0 score of 9.4 (critical), indicating high impact if exploited.
Mitigation Recommendations
Upgrade AsyncHttpClient to version 3.0.13 or later, or 2.16.1 or later. These versions contain the official fix for this vulnerability. No additional mitigation is required once updated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-10-07T15:53:23.585Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ac6be512cdf04f65681bbb4
Added to database: 10/07/2026, 21:49:05 UTC
Last enriched: 10/07/2026, 22:18:16 UTC
Last updated: 10/07/2026, 22:18:16 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.