AS
Product
async-http-client
24
CVEs
0
On KEV
9.4
Max CVSS
15
New 30D
Severity mix
Critical 1High 9Medium 11Low 3
Watch
Add async-http-client to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-107279 | 8.8 | Oct 7 | AsyncHttpClient: Digest mutual authentication is switched off by a peer offering qop=auth-int Affected: = 3.0.12 |
| CVE-2026-107231 | 8.7 | Oct 7 | AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext Affected: >= 3.0.0.Beta1, < 3.0.13; >= 2.0.0, < 2.16.1 |
| CVE-2026-107281 | 7.6 | Oct 7 | AsyncHttpClient: Connection pool key omits the authenticated principal, so an NTLM or Negotiate connection is reused across identities Affected: >= 3.0.0, < 3.0.13; >= 2.0.0, < 2.16.1 |
| CVE-2026-107232 | 7.5 | Oct 7 | AsyncHttpClient: Origin credentials sent in cleartext to a proxy that rejects the CONNECT Affected: >= 3.0.0, < 3.0.12; >= 2.0.0, < 2.16.1 |
| CVE-2026-107227 | 7.5 | Oct 7 | AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabled Affected: >= 3.0.0, < 3.0.14; >= 2.2.0, <= 2.16.1 |
| CVE-2026-85721 | 7.5 | Sep 17 | AsyncHttpClient: Unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of service Affected: >= 2.0.0, < 2.16.1; >= 3.0.0, < 3.0.12 |
| CVE-2026-85719 | 7.5 | Sep 17 | AsyncHttpClient: SOCKS proxy credentials sent to the origin server over plaintext HTTP Affected: >= 2.1.0, < 2.16.1; >= 3.0.0, < 3.0.12 |
| CVE-2026-107230 | 7.4 | Oct 7 | AsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy logins Affected: >= 3.0.0, < 3.0.14; >= 2.0.0, <= 2.16.1 |
| CVE-2026-45300 | 7.4 | Jun 5 | async-http-client: Cookie header not stripped on cross-origin redirect Affected: >= 3.0.0.Beta1, < 3.0.10; >= 2.0.0, < 2.15.0 |
Showing 9