Insufficient verification of data authenticity in Async-http-client - #VU142440
Published: August 13, 2026
Vulnerability identifier: #VU142440
CSH Severity: Low
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-345
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to inject unverified WebSocket frames into the client application.
The vulnerability exists due to insufficient verification of data authenticity in WebSocketHandler.upgrade() when processing a WebSocket handshake response with an invalid or missing Sec-WebSocket-Accept header. A remote attacker can send a crafted 101 response with WebSocket frames in the same TCP read to inject unverified WebSocket frames into the client application.
The request future completes exceptionally, onError is delivered before the spurious onOpen, and only frames included in the same TCP read as the 101 response are delivered.
Affected software
Async-http-client
Remediation
Install security update from vendor's website.
Async-http-client - addressed in versions 2.16.1, 3.0.12