AS
Product
async-http-client
24
CVEs
0
On KEV
9.4
Max CVSS
15
New 30D
Severity mix
Critical 1High 9Medium 11Low 3
Watch
Add async-http-client to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-107282 | 9.4 | Oct 7 | AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host Affected: >= 3.0.0, < 3.0.13; >= 2.0.0, < 2.16.1 |
| CVE-2026-107279 | 8.8 | Oct 7 | AsyncHttpClient: Digest mutual authentication is switched off by a peer offering qop=auth-int Affected: = 3.0.12 |
| CVE-2026-107231 | 8.7 | Oct 7 | AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext Affected: >= 3.0.0.Beta1, < 3.0.13; >= 2.0.0, < 2.16.1 |
| CVE-2026-107281 | 7.6 | Oct 7 | AsyncHttpClient: Connection pool key omits the authenticated principal, so an NTLM or Negotiate connection is reused across identities Affected: >= 3.0.0, < 3.0.13; >= 2.0.0, < 2.16.1 |
| CVE-2026-107232 | 7.5 | Oct 7 | AsyncHttpClient: Origin credentials sent in cleartext to a proxy that rejects the CONNECT Affected: >= 3.0.0, < 3.0.12; >= 2.0.0, < 2.16.1 |
| CVE-2026-107227 | 7.5 | Oct 7 | AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabled Affected: >= 3.0.0, < 3.0.14; >= 2.2.0, <= 2.16.1 |
| CVE-2026-85721 | 7.5 | Sep 17 | AsyncHttpClient: Unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of service Affected: >= 2.0.0, < 2.16.1; >= 3.0.0, < 3.0.12 |
| CVE-2026-85719 | 7.5 | Sep 17 | AsyncHttpClient: SOCKS proxy credentials sent to the origin server over plaintext HTTP Affected: >= 2.1.0, < 2.16.1; >= 3.0.0, < 3.0.12 |
| CVE-2026-107230 | 7.4 | Oct 7 | AsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy logins Affected: >= 3.0.0, < 3.0.14; >= 2.0.0, <= 2.16.1 |
| CVE-2026-45300 | 7.4 | Jun 5 | async-http-client: Cookie header not stripped on cross-origin redirect Affected: >= 3.0.0.Beta1, < 3.0.10; >= 2.0.0, < 2.15.0 |
| CVE-2026-107280 | 6.9 | Oct 7 | AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.uk Affected: >= 3.0.0, < 3.0.13; >= 2.0.0, < 2.16.1 |
| CVE-2026-107226 | 6.8 | Oct 12 | AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPS Affected: >= 2.1.0, <= 2.16.1; >= 3.0.0, < 3.0.14 |
| CVE-2026-107228 | 6.8 | Oct 7 | AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader (Bypass of CVE-2024-53990 Fix) Affected: >= 3.0.0, < 3.0.14; >= 2.1.0, <= 2.16.1 |
| CVE-2026-85717 | 6.8 | Sep 17 | AsyncHttpClient: Client-wide realm credentials re-sent to a cross-origin redirect target Affected: >= 2.14.5, < 2.16.1; >= 3.0.9, < 3.0.12 |
| CVE-2026-40490 | 6.8 | Apr 18 | AsyncHttpClient leaks authorization credentials to untrusted domains on cross-origin redirects Affected: >= 3.0.0.Beta1, < 3.0.9; < 2.14.5 |
| CVE-2026-107285 | 5.9 | Oct 7 | AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel Affected: >= 3.0.0, <3.0.12; >= 2.0.0, < 2.16.1 |
| CVE-2026-85720 | 5.9 | Sep 17 | AsyncHttpClient: Origin credentials sent to the proxy on the plaintext CONNECT request Affected: >= 2.0.0, < 2.16.1; >= 3.0.0, < 3.0.12 |
| CVE-2026-85718 | 5.9 | Sep 17 | AsyncHttpClient: Connection permit leak on TLS handshake failure causes per-host denial of service Affected: >= 3.0.8, < 3.0.12 |
| CVE-2026-102740 | 5.8 | Oct 15 | AsyncHttpClient: Resumable download index store is created world-readable and follows a planted symlink Affected: >= 2.0.0, < 2.16.1; >= 3.0.0, < 3.0.12 |
| CVE-2026-107229 | 4.0 | Oct 7 | AsyncHttpClient: Incomplete origin checks in the default cookie store allow cookie tossing onto public-suffix and IP-address hosts Affected: >= 3.0.11, < 3.0.14; >= 2.16.0, <= 2.16.1 |
| CVE-2026-55688 | 4.0 | Jul 1 | AsyncHttpClient: Cookie stored for an unrelated domain (cookie tossing) via ThreadSafeCookieStore Affected: >= 2.0.0, < 2.16.0; >= 3.0.0.Beta1, < 3.0.11 |
| CVE-2026-107284 | 3.7 | Oct 7 | AsyncHttpClient: WebSocket handshake continues after a failed Sec-WebSocket-Accept check Affected: >= 3.0.0, < 3.0.12; >= 2.0.0, < 2.16.1 |
| CVE-2026-107283 | 3.7 | Oct 7 | AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random source Affected: >= 3.0.0, < 3.0.12; >= 2.0.0, < 2.16.1 |
| CVE-2026-85716 | 3.7 | Sep 17 | AsyncHttpClient: SCRAM and Digest mutual-authentication responses are not verified Affected: >= 3.0.8, < 3.0.12 |
Showing 24