Link following in Async-http-client - #VU142445
Published: August 13, 2026
Vulnerability identifier: #VU142445
CSH Severity: Low
CVSS v4: 5.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-59
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to overwrite arbitrary files and disclose sensitive information.
The vulnerability exists due to improper link resolution before file access in PropertiesBasedResumableProcessor when saving and loading the resumable download index at a predictable path in the shared temp directory. A local user can plant a symbolic link or read the world-readable index file to overwrite arbitrary files and disclose sensitive information.
This applies when ResumableAsyncHandler is constructed to decorate another AsyncHandler; the no-argument constructors use a no-op processor and do not access the filesystem.
Affected software
Async-http-client
Remediation
Install security update from vendor's website.
Async-http-client - addressed in versions 2.16.1, 3.0.12