CVE-2026-107284: CWE-345: Insufficient Verification of Data Authenticity in AsyncHttpClient async-http-client

The AsyncHttpClient library for Java applications has a vulnerability (CVE-2026-107284) related to insufficient verification of data authenticity in its WebSocket handshake process. Specifically, in versions prior to 3.0.12 and 2.16.1, the WebSocketHandler.upgrade method aborts handshakes with missing or invalid Sec-WebSocket-Accept headers but continues with pipeline installation and onOpen event delivery. This allows frames coalesced with the invalid 101 response to be decoded and delivered from a peer that did not complete a valid handshake. The request future fails and the channel closes, but the improper frame delivery represents an integrity issue. The vulnerability is addressed in versions 3.0.12 and 2.16.1.

The vulnerability allows an attacker to send WebSocket frames that are processed and delivered despite the handshake being invalid or aborted. This represents an integrity issue where unverified data can be accepted by the client. There is no confidentiality or availability impact reported. The CVSS score is 3.7 (low severity), reflecting limited impact and the requirement for network attacker capability with high attack complexity.

Upgrade AsyncHttpClient to version 3.0.12 or later, or 2.16.1 or later, where this vulnerability is fixed. No other mitigation is indicated or necessary as the fix is available.