CVE-2026-107283: CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in AsyncHttpClient async-http-client

The AsyncHttpClient library's Realm.Builder component generates the HTTP Digest client nonce using ThreadLocalRandom instead of a cryptographically secure random source in versions prior to 3.0.12 and 2.16.1. Since the HTTP Digest authentication relies on an unpredictable cnonce to protect against chosen-plaintext and credential precomputation attacks, using a weak PRNG like ThreadLocalRandom allows an observer who can infer the generator state to reduce the protection of the authentication exchange. This vulnerability is identified as CWE-338 and has a CVSS v3.1 base score of 3.7 (low severity).

The use of a weak pseudo-random number generator for the client nonce in HTTP Digest authentication reduces the unpredictability of the nonce, potentially weakening the authentication mechanism. However, the impact is limited to confidentiality (partial information disclosure risk) with no integrity or availability impact. There are no known exploits in the wild.

Upgrade AsyncHttpClient to version 3.0.12 or later, or 2.16.1 or later, where the issue is fixed by using a cryptographically secure random source for nonce generation.