Security
فارسی
All products

org.asynchttpclient:async-http-client

Maven · Package
18 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
AsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy loginsCVE-2026-107230 · GHSA-V2J5-22FR-J62R org.asynchttpclient:async-http-client Maven High Fix reported
AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader (Bypass of CVE-2024-53990 Fix)CVE-2026-107228 · GHSA-2JWH-9RMR-J4XF org.asynchttpclient:async-http-clientRed Hat Fuse 7/async-http-client MavenRed Hat Medium Fix reported
AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPSCVE-2026-107226 · GHSA-P2JM-6HJ6-9RJG org.asynchttpclient:async-http-clientRed Hat Fuse 7/async-http-client MavenRed Hat Medium Fix reported
AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabledCVE-2026-107227 · GHSA-X8V2-478Q-2HVG org.asynchttpclient:async-http-client Maven High Fix reported
AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random sourceCVE-2026-107283 · GHSA-MFJ3-87QQ-382V org.asynchttpclient:async-http-clientRed Hat Fuse 7/async-http-client MavenRed Hat Low Fix reported
AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.ukCVE-2026-107280 · GHSA-F9M8-CV68-674W org.asynchttpclient:async-http-clientRed Hat Fuse 7/async-http-client MavenRed Hat Medium Fix reported
AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new hostCVE-2026-107282 · GHSA-JMQQ-X5G9-9P2W org.asynchttpclient:async-http-client Maven Critical Fix reported
AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnelCVE-2026-107285 · GHSA-3WP9-XFWM-RJJF org.asynchttpclient:async-http-clientRed Hat Fuse 7/async-http-client MavenRed Hat Medium Fix reported
AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartextCVE-2026-107231 · GHSA-RQF5-2WXV-RJF4 org.asynchttpclient:async-http-client Maven High Fix reported
AsyncHttpClient re-sends client-wide realm credentials to a cross-origin redirect targetCVE-2026-85717 · GHSA-F8M2-889X-VW4X org.asynchttpclient:async-http-client Maven Medium Fix reported
AsyncHttpClient doesn't verify SCRAM and Digest mutual-authentication responsesCVE-2026-85716 · GHSA-FJ9W-C36G-H5X8 org.asynchttpclient:async-http-clientRed Hat Fuse 7/async-http-client MavenRed Hat Low Fix reported
AsyncHttpClient sends origin credentials to the proxy on the plaintext CONNECT requestCVE-2026-85720 · GHSA-XR57-GCX8-52HF org.asynchttpclient:async-http-clientRed Hat Fuse 7/async-http-client MavenRed Hat Medium Fix reported
AsyncHttpClient's unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of serviceCVE-2026-85721 · GHSA-7GRG-JCF7-RPMX org.asynchttpclient:async-http-client Maven High Fix reported
AsyncHttpClient stores cookie for an unrelated domain (cookie tossing) via ThreadSafeCookieStoreCVE-2026-55688 · GHSA-M452-Q8C9-RG2F org.asynchttpclient:async-http-clientRed Hat JBoss Enterprise Application Platform Expansion Pack/async-http-client-netty-utils MavenRed Hat Medium Fix reported
async-http-client: Cookie header not stripped on cross-origin redirectCVE-2026-45300 · GHSA-FMXF-PM6P-7XGM org.asynchttpclient:async-http-client Maven High Fix reported
AsyncHttpClient leaks authorization credentials to untrusted domains on cross-origin redirectsCVE-2026-40490 · GHSA-CMXV-58FP-FM3G org.asynchttpclient:async-http-clientRed Hat Fuse 7/org.asynchttpclient/async-http-client MavenRed Hat Medium Fix reported
AsyncHttpClient (AHC) library's `CookieStore` replaces explicitly defined `Cookie`sCVE-2024-53990 · GHSA-MFJ5-CF8G-G2FV org.asynchttpclient:async-http-clientRed Hat Fuse 7/org.asynchttpclient/async-http-client MavenRed Hat Critical Fix reported
Improper Input Validation in async-http-clientCVE-2017-14063 · GHSA-93JQ-624G-4P9P org.asynchttpclient:async-http-clientRed Hat JBoss Fuse 6/async-http-client MavenRed Hat High Fix reported