Low severity · published Oct 7, 2026
CVE-2026-107283
AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random source
3.7
CVSS
0.3%
EPSS
No
On KEV
Description
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, Realm.Builder generates the HTTP Digest client nonce with ThreadLocalRandom rather than a cryptographically secure random source. Digest relies on an unpredictable cnonce to resist chosen-plaintext and credential precomputation attacks, so an observer able to infer generator state can reduce the protection of the authentication exchange. This issue is fixed in versions 3.0.12 and 2.16.1.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 18% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AS
async-http-client · AsyncHttpClient
>= 3.0.0, < 3.0.12; >= 2.0.0, < 2.16.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-107283
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-107283
x_refsource_CONFIRM
https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-mfj3-87qq-382v
x_refsource_MISC
https://github.com/AsyncHttpClient/async-http-client/commit/dca2d90db87f0144ea893a6858dca13c426d06b6
x_refsource_MISC
https://github.com/AsyncHttpClient/async-http-client/commit/e1f5fc88fe211d3f64032c33b91093ba3d5e793d
x_refsource_MISC
https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-2.16.1
x_refsource_MISC
https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.12
More from async-http-client
9.4
CVE-2026-107282
AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host
8.8
CVE-2026-107279
AsyncHttpClient: Digest mutual authentication is switched off by a peer offering qop=auth-int
8.7
CVE-2026-107231
AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext
7.6
CVE-2026-107281
AsyncHttpClient: Connection pool key omits the authenticated principal, so an NTLM or Negotiate connection is reused across identities
7.5
CVE-2026-107232
AsyncHttpClient: Origin credentials sent in cleartext to a proxy that rejects the CONNECT