Cleartext transmission of sensitive information in Async-http-client - #VU142436
Published: August 13, 2026
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to cleartext transmission of sensitive information in NettyRequestSender tunnel state handling when reusing a connection after a proxy rejects a CONNECT request. A remote attacker can respond to the CONNECT with a crafted 401 or 302 response to disclose sensitive information.
The issue occurs because the client treats the connection as tunnelled based on the last built request rather than on whether the CONNECT request actually succeeded. For Basic authentication, credentials are directly reversible, and NTLM authentication can expose a Type 3 message that is offline-crackable and relayable against the origin.