SB2026081397 - Multiple vulnerabilities in Async-http-client

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026081397

SB2026081397 - Multiple vulnerabilities in Async-http-client

Published: August 13, 2026

Security Bulletin ID SB2026081397
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 17
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 76% Low 24%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 17 vulnerabilities.


1) Insufficiently protected credentials (CVE-ID: N/A)

CWE-ID: CWE-522 - Insufficiently Protected Credentials

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to insufficiently protected credentials in NettyRequestFactory#newNettyRequest and requestUri() when sending a WebSocket upgrade request through an HTTP CONNECT tunnel for ws:// requests. A remote attacker can observe a tunneled proxied ws:// connection or operate the origin server to disclose sensitive information.

Proxy credentials may be exposed directly for Basic authentication, or as a replayable and offline-crackable response for Digest authentication.


2) Improper handling of highly compressed data (CVE-ID: N/A)

CWE-ID: CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of highly compressed data in the HTTP/1.1 response decompressor when processing compressed response bodies with automatic decompression enabled. A remote attacker can send a small compressed response that expands without bound in memory to cause a denial of service.

gzip, deflate, and snappy are available vectors by default, while brotli and zstd apply only when the corresponding optional codecs are on the classpath.


3) Cleartext transmission of sensitive information (CVE-ID: N/A)

CWE-ID: CWE-319 - Cleartext Transmission of Sensitive Information

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to cleartext transmission of sensitive information in the HTTP CONNECT tunnel setup in Async-http-client when sending requests through an HTTP proxy to an HTTPS origin with preemptive origin authentication. A remote attacker can observe a plaintext CONNECT request carrying origin credentials or authentication tokens to disclose sensitive information.

The issue affects Basic credentials as well as NTLM, SPNEGO, and Kerberos tokens on the client-to-proxy hop before TLS is established.


4) Cleartext transmission of sensitive information (CVE-ID: N/A)

CWE-ID: CWE-319 - Cleartext Transmission of Sensitive Information

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to cleartext transmission of sensitive information in SOCKS proxy authentication handling when sending requests through a SOCKS proxy over plaintext HTTP. A remote attacker can operate a hostile origin server or observe traffic on the origin side of the connection to obtain proxy credentials and disclose sensitive information.

Without preemptive proxy authentication, a hostile origin can reply with a 407 challenge and cause the client to send the proxy credentials over the same tunnel. Connection-oriented authentication schemes including NTLM, Kerberos, and SPNEGO are affected.


5) Insufficiently protected credentials (CVE-ID: N/A)

CWE-ID: CWE-522 - Insufficiently Protected Credentials

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive credentials to a cross-origin redirect target.

The vulnerability exists due to insufficiently protected credentials in the redirect handling logic when following cross-origin redirects after a 401 response. A remote attacker can control a redirect target and trigger credential re-sending to disclose sensitive credentials to a cross-origin redirect target.

Only clients configured with a client-wide realm and following redirects are vulnerable. The issue occurs when credentials are re-derived from the client configuration after the per-exchange realm has been cleared.


6) Missing Release of Resource after Effective Lifetime (CVE-ID: N/A)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to missing release of resource after effective lifetime in NettyConnectListener when handling TLS connection failures before the handshake completes. A remote attacker can trigger repeated failed TLS connection attempts to cause a denial of service.

The issue is exploitable only when a connection limit is configured greater than zero; with per-host limits a single host can be locked out, while global limits can block access to every host.


7) Detection of Error Condition Without Action (CVE-ID: N/A)

CWE-ID: CWE-390 - Detection of error condition without action

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to spoof mutual authentication.

The vulnerability exists due to detection of error condition without action in the auth interceptor when processing SCRAM or Digest mutual-authentication responses. A remote attacker can present an invalid ServerSignature or rspauth value to spoof mutual authentication.

The issue is relevant over non-TLS transport or when the transport is already compromised. If the verification value is omitted entirely or cannot be recovered from the client\'s sent parameters, the response is still accepted.


8) Cleartext transmission of sensitive information (CVE-ID: N/A)

CWE-ID: CWE-319 - Cleartext Transmission of Sensitive Information

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to cleartext transmission of sensitive information in the HTTP proxy request line handling in Async-http-client when routing plaintext HTTP requests through an HTTP proxy using a URL that contains userinfo credentials. A remote attacker can route or observe a specially crafted request to disclose sensitive information.

The issue affects only the HTTP/1.1 absolute-form proxy request target and can expose embedded URL credentials to the proxy and to observers of the client-to-proxy hop.


9) Link following (CVE-ID: N/A)

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

CVSSv4: 5.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a local user to overwrite arbitrary files and disclose sensitive information.

The vulnerability exists due to improper link resolution before file access in PropertiesBasedResumableProcessor when saving and loading the resumable download index at a predictable path in the shared temp directory. A local user can plant a symbolic link or read the world-readable index file to overwrite arbitrary files and disclose sensitive information.

This applies when ResumableAsyncHandler is constructed to decorate another AsyncHandler; the no-argument constructors use a no-op processor and do not access the filesystem.


10) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to access data under another user\'s identity.

The vulnerability exists due to incorrect authorization in ChannelPoolPartitioning.PerHostChannelPoolPartitioning.getPartitionKey when reusing NTLM or Negotiate authenticated connections across requests for different principals. A remote attacker can send requests through a client configured with per-request credentials to access data under another user\'s identity.

Only NTLM and Negotiate are affected because they authenticate the connection rather than each individual request.


11) Insufficient verification of data authenticity (CVE-ID: N/A)

CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to inject unverified WebSocket frames into the client application.

The vulnerability exists due to insufficient verification of data authenticity in WebSocketHandler.upgrade() when processing a WebSocket handshake response with an invalid or missing Sec-WebSocket-Accept header. A remote attacker can send a crafted 101 response with WebSocket frames in the same TCP read to inject unverified WebSocket frames into the client application.

The request future completes exceptionally, onError is delivered before the spurious onOpen, and only frames included in the same TCP read as the 101 response are delivered.


12) Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) (CVE-ID: N/A)

CWE-ID: CWE-338 - Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to reduce the unpredictability of digest authentication nonces and disclose sensitive information.

The vulnerability exists due to use of a cryptographically weak pseudorandom number generator in Realm.Builder cnonce generation when generating the client nonce for HTTP Digest authentication. A remote attacker can observe or influence enough generator output to reduce the unpredictability of digest authentication nonces and disclose sensitive information.

The issue affects the cnonce used by HTTP Digest authentication, which RFC 7616 requires to be unpredictable to help protect against chosen-plaintext and precomputation attacks on credentials.


13) Cleartext transmission of sensitive information (CVE-ID: N/A)

CWE-ID: CWE-319 - Cleartext Transmission of Sensitive Information

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to cleartext transmission of sensitive information in NettyRequestSender tunnel state handling when reusing a connection after a proxy rejects a CONNECT request. A remote attacker can respond to the CONNECT with a crafted 401 or 302 response to disclose sensitive information.

The issue occurs because the client treats the connection as tunnelled based on the last built request rather than on whether the CONNECT request actually succeeded. For Basic authentication, credentials are directly reversible, and NTLM authentication can expose a Type 3 message that is offline-crackable and relayable against the origin.


14) Algorithm Downgrade (CVE-ID: N/A)

CWE-ID: CWE-757 - Selection of Less-Secure Algorithm During Negotiat

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive credentials.

The vulnerability exists due to selection of a less-secure algorithm during negotiation in parseWWWAuthenticateHeader and parseProxyAuthenticateHeader when processing Digest authentication challenges without a usable nonce. A remote attacker can send a crafted WWW-Authenticate or Proxy-Authenticate challenge to disclose sensitive credentials.

This affects both origin and proxy authentication paths, and user interaction is not required.


15) Insufficiently protected credentials (CVE-ID: N/A)

CWE-ID: CWE-522 - Insufficiently Protected Credentials

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to insufficiently protected credentials in replay handling in async-http-client when replaying a request to a different host. A remote attacker can receive a replayed request or credentials on a different host to disclose sensitive information.

The issue can also cause requests and credentials to be sent in cleartext when the original request used HTTP and the replayed request used HTTPS.


16) Incorrect Implementation of Authentication Algorithm (CVE-ID: N/A)

CWE-ID: CWE-303 - Incorrect Implementation of Authentication Algorithm

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to impersonate the authenticated server.

The vulnerability exists due to incorrect implementation of an authentication algorithm in Digest mutual authentication handling when processing a Digest challenge offering qop=\"auth-int\". A remote attacker can offer a crafted Digest challenge and return an arbitrary rspauth value to impersonate the authenticated server.

An on-path attacker or a server impersonating the real origin may be accepted as genuine, and the client\'s credentials are not disclosed by this issue.


17) Origin validation error (CVE-ID: N/A)

CWE-ID: CWE-346 - Origin Validation Error

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to set arbitrary cookies for a public suffix and influence applications that trust those cookies.

The vulnerability exists due to improper access control in the cookie store domain validation logic when processing Set-Cookie headers with a Domain attribute naming a public suffix. A remote attacker can send a crafted cookie response from a host under the same public suffix to set arbitrary cookies for a public suffix and influence applications that trust those cookies.

Exploitation requires control of a host under the same multi-label public suffix as the victim, such as co.uk, com.au, or github.io.


Remediation

Install update from vendor's website.

References