Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in Async-http-client - #VU142438
Published: August 13, 2026
Vulnerability identifier: #VU142438
CSH Severity: Low
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-338
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to reduce the unpredictability of digest authentication nonces and disclose sensitive information.
The vulnerability exists due to use of a cryptographically weak pseudorandom number generator in Realm.Builder cnonce generation when generating the client nonce for HTTP Digest authentication. A remote attacker can observe or influence enough generator output to reduce the unpredictability of digest authentication nonces and disclose sensitive information.
The issue affects the cnonce used by HTTP Digest authentication, which RFC 7616 requires to be unpredictable to help protect against chosen-plaintext and precomputation attacks on credentials.
Affected software
Async-http-client
Remediation
Install security update from vendor's website.
Async-http-client - addressed in versions 2.16.1, 3.0.12