The AsyncHttpClient library allows Java applications to execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 and 3.0.12, PropertiesBasedResumableProcessor stores resumable download state at the predictable shared path $java.io.tmpdir/ahc/ResumableAsyncHandler.properties with default permissions and link-following file operations. A local user who can read the shared store can see download URLs, including embedded user information or query tokens. A local user who can write within or pre-create the affected shared store directory can plant a symbolic link that the client follows when saving state, truncating and overwriting a target file writable by the client process. The filesystem path is used when ResumableAsyncHandler decorates another AsyncHandler, while the no-argument constructors use a no-op processor and are unaffected. This issue is fixed in versions 2.16.1 and 3.0.12.
AsyncHttpClient versions from 2.1.0 up to 2.16.1 and 3.0.0 up to but not including 3.0.14 have a session fixation vulnerability in the default ThreadSafeCookieStore. This flaw allows Secure cookies received over plaintext to be accepted and insecure cookies to overwrite or delete existing Secure cookies, enabling an attacker to manipulate cookie state sent to HTTPS origins. The issue is fixed in version 3.0.14.
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, a proxied ws request is carried through CONNECT, but NettyRequestFactory.newNettyRequest and requestUri decide whether to attach proxy authentication and an absolute-form target only from whether the URI is secure. Because ws is not marked secure, the tunneled WebSocket upgrade sent to the origin includes the proxy's Proxy-Authorization value. Basic credentials are directly recoverable and Digest responses can be replayed or cracked offline. This issue is fixed in versions 3.0.12 and 2.16.1.
AsyncHttpClient versions prior to 3.0.12 and 2.16.1 contain a vulnerability where the WebSocketHandler.upgrade method improperly processes WebSocket handshakes with missing or invalid Sec-WebSocket-Accept values. Although the handshake is aborted, the pipeline installation and onOpen event still proceed, allowing frames from an unverified peer to be decoded and delivered. This issue is resolved in versions 3.0.12 and 2.16.1.
AsyncHttpClient versions prior to 3.0.12 and 2.16.1 use a cryptographically weak pseudo-random number generator (ThreadLocalRandom) to generate the HTTP Digest client nonce (cnonce). This weak randomness reduces the security of the authentication exchange by making the nonce more predictable. The issue is fixed in versions 3.0.12 and 2.16.1.
CVE-2026-107282 is a critical vulnerability in the AsyncHttpClient (AHC) Java library that allows cleartext transmission of sensitive information. Versions prior to 3.0.13 and 2.16.1 have a flaw where cross-host request replay can cause the original host's sensitive data, including path, Host header, and Authorization credentials, to be sent to an unintended replay destination. This occurs due to improper updating of the target request and proxy context during failover and retry scenarios. The issue is fixed in versions 3.0.13 and 2.16.1.
AsyncHttpClient versions prior to 3.0.13 and 2.16.1 contain an origin validation error affecting connection pooling with NTLM and Negotiate authentication. The connection pool key does not include the authenticated principal, allowing a pooled socket authenticated for one user to be reused by another, causing the server to execute requests under the wrong identity. Basic and Digest authentication methods are not affected. This vulnerability is fixed in versions 3.0.13 and 2.16.1.
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.2.0 until 3.0.14, WebSocket permessage-deflate decompression is unbounded when compression is enabled. The inbound pipeline aggregates compressed frames before WebSocketClientCompressionHandler inflates them, so webSocketMaxFrameSize and webSocketMaxBufferSize do not bound decompressed output. A malicious WebSocket peer can send a small compressed message that expands to a very large Netty buffer and exhausts JVM heap. This issue is fixed in version 3.0.14.
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.16.0 until 3.0.14, ThreadSafeCookieStore incompletely validates cookie Domain attributes. Missing private-section and default public-suffix rules, absent A-label normalization, locale-sensitive lowercasing, public-suffix host-only handling, and numeric or IP host checks allow one origin to store a cookie later sent to another origin. Applications sharing one client across trust domains can therefore receive attacker-injected cookies and may be exposed to session fixation. This issue is fixed in version 3.0.14.
AsyncHttpClient versions prior to 3.0.13 and 2.16.1 contain a vulnerability in the ThreadSafeCookieStore where domain attributes are validated but public suffixes are not rejected. This allows a host under a public suffix (e.g., co.uk) to set cookies for the entire suffix, causing cookies to be shared across unrelated hosts. This can lead to injection or overwriting of session-relevant cookies across origins. The issue is fixed in versions 3.0.13 and 2.16.1.
CVE-2026-107279 is a high-severity vulnerability in AsyncHttpClient version 3.0.12 where the authentication algorithm incorrectly handles Digest qop=auth-int. This flaw causes the mutual-authentication verification to be skipped, allowing a peer that does not know the shared secret to be accepted as an authenticated server. The issue is fixed in version 3.0.13.
AsyncHttpClient versions prior to 3.0.12 on the 3.x branch and 2.16.1 on the 2.x branch have a vulnerability where sensitive credentials can be transmitted in cleartext over a proxy connection. This occurs because the client incorrectly infers proxy tunnel status, allowing authorization credentials to be sent without encryption after a proxy rejects a CONNECT request. The issue is fixed in versions 3.0.12 and 2.16.1.
AsyncHttpClient versions prior to 3.0.13 and 2.16.1 contain a vulnerability where Digest authentication challenges with missing or empty nonces are incorrectly treated as Basic authentication challenges. This causes the client to resend credentials in cleartext using Basic authentication, exposing sensitive information. The issue affects both origin and proxy challenge parsers and has been fixed in versions 3.0.13 and 2.16.1.
AsyncHttpClient versions from 2.0.0 up to 2.16.1 and from 3.0.0 up to but not including 3.0.14 contain an origin validation error related to connection-pool partitioning. This flaw allows reuse of sockets authenticated as different identities in Kerberos, SPNEGO, NTLM, and proxy connections, potentially exposing one user's data or authority to another. The issue is fixed in version 3.0.14.
AsyncHttpClient versions from 2.1.0 up to 2.16.1 and from 3.0.0 up to but not including 3.0.14 have an improper authentication vulnerability. The enabled-by-default cookie store can overwrite explicitly set Cookie headers in HTTP requests, causing requests to execute under the wrong user session. This bypasses previous remediation efforts and can lead to session confusion. The issue is fixed in version 3.0.14.
AsyncHttpClient versions from 3.0.8 up to but not including 3.0.12 contain an improper authentication vulnerability in the SCRAM and Digest authentication processing. The library logs mismatches in server signature verification but still accepts the response as authenticated, potentially allowing an unauthenticated peer to be accepted as the server on non-TLS or compromised transports. This issue is fixed in version 3.0.12.
AsyncHttpClient versions from 2.0.0 up to but not including 2.16.1, and from 3.0.0 up to but not including 3.0.12, have a vulnerability where preemptive origin credentials are sent in cleartext in the HTTP CONNECT request when using an HTTP proxy to reach an HTTPS origin. This exposes sensitive authentication tokens to the proxy and any observers on the client-to-proxy connection. The issue is fixed in versions 2.16.1 and 3.0.12.
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 3.0.8 until 3.0.12, a client with maxConnections or maxConnectionsPerHost set above zero leaks one connection permit whenever TLS connection establishment fails before the handshake completes. NettyConnectListener removes the partitionKeyLock permit from NettyResponseFuture before every failure path is bound to the channel closeFuture, so an abort can leave the permit unreleased. Repeated failures can permanently lock out one host under a per-host limit or drain the shared pool under a global limit, blocking later requests even when no connection remains open. The default unlimited connection setting is not affected. This issue is fixed in version 3.0.12.
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 and 3.0.12, automatic response decompression on the HTTP/1.1 path uses ChannelManager.newHttpContentDecompressor() to install Http1ContentDecompressor without a cumulative output-size limit. A hostile or compromised server, or an attacker who can alter a response in transit, can send a small gzip, deflate, or snappy response that expands across chunks until the client exhausts its heap and raises OutOfMemoryError; brotli and zstd are also affected when their optional codecs are present. In versions 3.0.8 through 3.0.10, the HTTP/2 decompressor is also unbounded, so switching protocols does not mitigate the issue on those releases. A limit applied to each decode call is insufficient because the response can be delivered as many small chunks, so the fixed implementation tracks total decompressed bytes for the whole response. This issue is fixed in versions 2.16.1 and 3.0.12.
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.14.5 to 2.16.0 and from 3.0.9 to 3.0.11, a client configured with a client-wide Realm and redirect following can disclose credentials after a cross-origin redirect because the Interceptors authentication path falls back to the client configuration after redirect handling clears the per-exchange realm. If the attacker-controlled target returns 401, the client can send Basic or Digest credentials or a Negotiate or NTLM token to that origin. Per-request realms are stripped correctly, and this issue is a residual bypass of the earlier cross-origin credential-stripping fixes. This issue is fixed in versions 2.16.1 and 3.0.12.