CVE-2026-85719: CWE-319: Cleartext Transmission of Sensitive Information in AsyncHttpClient async-http-client
AsyncHttpClient versions from 2.1.0 up to but not including 2.16.1, and from 3.0.0 up to but not including 3.0.12, have a vulnerability where proxy credentials can be exposed in cleartext. This occurs when using an authenticated SOCKS proxy with preemptive proxy authentication, causing Proxy-Authorization headers to be sent to the origin server over plaintext HTTP requests. The issue is fixed in versions 2.16.1 and 3.0.12.
AI Analysis
Technical Summary
The AsyncHttpClient library versions >=2.1.0 <2.16.1 and >=3.0.0 <3.0.12 improperly attach Proxy-Authorization headers when using an authenticated SOCKS proxy without verifying that the request is sent to an HTTP proxy. With preemptive proxy authentication, this causes proxy credentials, including Basic credentials, to be sent in cleartext to the origin server. In the default non-preemptive flow, a malicious origin can trigger a 407 response causing ProxyUnauthorized407Interceptor to send proxy credentials through the SOCKS tunnel, exposing NTLM, Kerberos, and SPNEGO credentials. This vulnerability is resolved in versions 2.16.1 and 3.0.12.
Potential Impact
The vulnerability allows exposure of sensitive proxy authentication credentials to the origin server, including reversible Basic credentials and other authentication tokens (NTLM, Kerberos, SPNEGO). This can lead to credential compromise without requiring user interaction or privileges. The confidentiality of proxy credentials is compromised, but there is no direct impact on integrity or availability.
Mitigation Recommendations
Upgrade AsyncHttpClient to version 2.16.1 or later, or 3.0.12 or later, where this issue is fixed. No other mitigations are indicated by the vendor advisory. Patch status is confirmed fixed in these versions.
CVE-2026-85719: CWE-319: Cleartext Transmission of Sensitive Information in AsyncHttpClient async-http-client
Description
AsyncHttpClient versions from 2.1.0 up to but not including 2.16.1, and from 3.0.0 up to but not including 3.0.12, have a vulnerability where proxy credentials can be exposed in cleartext. This occurs when using an authenticated SOCKS proxy with preemptive proxy authentication, causing Proxy-Authorization headers to be sent to the origin server over plaintext HTTP requests. The issue is fixed in versions 2.16.1 and 3.0.12.
CVSS v3.1
Score 7.5high
Affected software
AsyncHttpClient
async-http-client
pkg:maven/org.asynchttpclient/async-http-clientRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The AsyncHttpClient library versions >=2.1.0 <2.16.1 and >=3.0.0 <3.0.12 improperly attach Proxy-Authorization headers when using an authenticated SOCKS proxy without verifying that the request is sent to an HTTP proxy. With preemptive proxy authentication, this causes proxy credentials, including Basic credentials, to be sent in cleartext to the origin server. In the default non-preemptive flow, a malicious origin can trigger a 407 response causing ProxyUnauthorized407Interceptor to send proxy credentials through the SOCKS tunnel, exposing NTLM, Kerberos, and SPNEGO credentials. This vulnerability is resolved in versions 2.16.1 and 3.0.12.
Potential Impact
The vulnerability allows exposure of sensitive proxy authentication credentials to the origin server, including reversible Basic credentials and other authentication tokens (NTLM, Kerberos, SPNEGO). This can lead to credential compromise without requiring user interaction or privileges. The confidentiality of proxy credentials is compromised, but there is no direct impact on integrity or availability.
Mitigation Recommendations
Upgrade AsyncHttpClient to version 2.16.1 or later, or 3.0.12 or later, where this issue is fixed. No other mitigations are indicated by the vendor advisory. Patch status is confirmed fixed in these versions.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-09-04T14:45:10.648Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aac0f0b55bf5e2cf5988207
Added to database: 09/17/2026, 16:02:19 UTC
Last enriched: 09/17/2026, 16:16:36 UTC
Last updated: 09/17/2026, 16:44:27 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.