Insufficient verification of data authenticity in Async-http-client - CVE-2026-107284
Published: August 13, 2026 / Updated: October 9, 2026
Vulnerability identifier: #VU142440
CSH Severity: Low
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-107284
CWE-ID: CWE-345
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to inject unverified WebSocket frames into the client application.
The vulnerability exists due to insufficient verification of data authenticity in WebSocketHandler.upgrade() when processing a WebSocket handshake response with an invalid or missing Sec-WebSocket-Accept header. A remote attacker can send a crafted 101 response with WebSocket frames in the same TCP read to inject unverified WebSocket frames into the client application.
The request future completes exceptionally, onError is delivered before the spurious onOpen, and only frames included in the same TCP read as the 101 response are delivered.
Affected software
Async-http-client
How to mitigate CVE-2026-107284
Install security update from vendor's website.
Async-http-client - addressed in versions 2.16.1, 3.0.12