Medium severity · published Sep 17, 2026
CVE-2026-85718
AsyncHttpClient: Connection permit leak on TLS handshake failure causes per-host denial of service
5.9
CVSS
0.5%
EPSS
No
On KEV
Description
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 3.0.8 until 3.0.12, a client with maxConnections or maxConnectionsPerHost set above zero leaks one connection permit whenever TLS connection establishment fails before the handshake completes. NettyConnectListener removes the partitionKeyLock permit from NettyResponseFuture before every failure path is bound to the channel closeFuture, so an abort can leave the permit unreleased. Repeated failures can permanently lock out one host under a per-host limit or drain the shared pool under a global limit, blocking later requests even when no connection remains open. The default unlimited connection setting is not affected. This issue is fixed in version 3.0.12.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 45% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AS
async-http-client · AsyncHttpClient
>= 3.0.8, < 3.0.12 · source: vendor
Affected product
AS
async-http-client
AsyncHttpClient
More from async-http-client
9.4
CVE-2026-107282
AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host
8.8
CVE-2026-107279
AsyncHttpClient: Digest mutual authentication is switched off by a peer offering qop=auth-int
8.7
CVE-2026-107231
AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext
7.6
CVE-2026-107281
AsyncHttpClient: Connection pool key omits the authenticated principal, so an NTLM or Negotiate connection is reused across identities
7.5
CVE-2026-107232
AsyncHttpClient: Origin credentials sent in cleartext to a proxy that rejects the CONNECT