CVE-2026-85721: CWE-400: Uncontrolled Resource Consumption in AsyncHttpClient async-http-client
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 and 3.0.12, automatic response decompression on the HTTP/1.1 path uses ChannelManager.newHttpContentDecompressor() to install Http1ContentDecompressor without a cumulative output-size limit. A hostile or compromised server, or an attacker who can alter a response in transit, can send a small gzip, deflate, or snappy response that expands across chunks until the client exhausts its heap and raises OutOfMemoryError; brotli and zstd are also affected when their optional codecs are present. In versions 3.0.8 through 3.0.10, the HTTP/2 decompressor is also unbounded, so switching protocols does not mitigate the issue on those releases. A limit applied to each decode call is insufficient because the response can be delivered as many small chunks, so the fixed implementation tracks total decompressed bytes for the whole response. This issue is fixed in versions 2.16.1 and 3.0.12.
AI Analysis
Technical Summary
The AsyncHttpClient library allows asynchronous HTTP requests in Java applications. Versions >=2.0.0 <2.16.1 and >=3.0.0 <3.0.12 have a vulnerability in their automatic response decompression mechanism. On the HTTP/1.1 path, the Http1ContentDecompressor is installed without a cumulative output-size limit, allowing a malicious server or attacker to send a small compressed response that expands excessively during decompression, exhausting heap memory and causing an OutOfMemoryError. Brotli and zstd codecs are also affected if present. Additionally, versions 3.0.8 through 3.0.10 have an unbounded HTTP/2 decompressor, so protocol switching does not mitigate the issue. The fix involves tracking total decompressed bytes for the entire response to enforce limits. The vulnerability is identified as CWE-400 (Uncontrolled Resource Consumption) and CWE-409.
Potential Impact
An attacker controlling or modifying HTTP responses can cause the AsyncHttpClient to consume excessive memory during decompression, leading to an OutOfMemoryError and potential denial of service in the client application. There is no direct impact on confidentiality or integrity, but availability is affected due to resource exhaustion.
Mitigation Recommendations
This vulnerability is fixed in AsyncHttpClient versions 2.16.1 and 3.0.12. Users should upgrade to these or later versions to mitigate the issue. No other mitigations are indicated by the vendor advisory. Patch status is confirmed by the vendor advisory.
CVE-2026-85721: CWE-400: Uncontrolled Resource Consumption in AsyncHttpClient async-http-client
Description
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 and 3.0.12, automatic response decompression on the HTTP/1.1 path uses ChannelManager.newHttpContentDecompressor() to install Http1ContentDecompressor without a cumulative output-size limit. A hostile or compromised server, or an attacker who can alter a response in transit, can send a small gzip, deflate, or snappy response that expands across chunks until the client exhausts its heap and raises OutOfMemoryError; brotli and zstd are also affected when their optional codecs are present. In versions 3.0.8 through 3.0.10, the HTTP/2 decompressor is also unbounded, so switching protocols does not mitigate the issue on those releases. A limit applied to each decode call is insufficient because the response can be delivered as many small chunks, so the fixed implementation tracks total decompressed bytes for the whole response. This issue is fixed in versions 2.16.1 and 3.0.12.
CVSS v3.1
Score 7.5high
Affected software
AsyncHttpClient
async-http-client
pkg:maven/org.asynchttpclient/async-http-clientRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The AsyncHttpClient library allows asynchronous HTTP requests in Java applications. Versions >=2.0.0 <2.16.1 and >=3.0.0 <3.0.12 have a vulnerability in their automatic response decompression mechanism. On the HTTP/1.1 path, the Http1ContentDecompressor is installed without a cumulative output-size limit, allowing a malicious server or attacker to send a small compressed response that expands excessively during decompression, exhausting heap memory and causing an OutOfMemoryError. Brotli and zstd codecs are also affected if present. Additionally, versions 3.0.8 through 3.0.10 have an unbounded HTTP/2 decompressor, so protocol switching does not mitigate the issue. The fix involves tracking total decompressed bytes for the entire response to enforce limits. The vulnerability is identified as CWE-400 (Uncontrolled Resource Consumption) and CWE-409.
Potential Impact
An attacker controlling or modifying HTTP responses can cause the AsyncHttpClient to consume excessive memory during decompression, leading to an OutOfMemoryError and potential denial of service in the client application. There is no direct impact on confidentiality or integrity, but availability is affected due to resource exhaustion.
Mitigation Recommendations
This vulnerability is fixed in AsyncHttpClient versions 2.16.1 and 3.0.12. Users should upgrade to these or later versions to mitigate the issue. No other mitigations are indicated by the vendor advisory. Patch status is confirmed by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-09-04T14:45:10.648Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aac242c55bf5e2cf5ad8ff6
Added to database: 09/17/2026, 17:32:28 UTC
Last enriched: 09/17/2026, 17:46:45 UTC
Last updated: 09/18/2026, 02:51:37 UTC
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.