Login Request a demo
AS
Product
async-http-client
by AsyncHttpClient · last CVE Oct 15, 2026
24
CVEs
0
On KEV
9.4
Max CVSS
15
New 30D
Vulnerabilities24In the news0Timeline
Severity mix
Critical 1High 9Medium 11Low 3
Severity
All severities24Critical1High9Medium11Low3
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add async-http-client to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-107280
6.9
0%
Oct 7
AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.uk
Affected: >= 3.0.0, < 3.0.13; >= 2.0.0, < 2.16.1
CVE-2026-107226
6.8
0%
Oct 12
AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPS
Affected: >= 2.1.0, <= 2.16.1; >= 3.0.0, < 3.0.14
CVE-2026-107228
6.8
0%
Oct 7
AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader (Bypass of CVE-2024-53990 Fix)
Affected: >= 3.0.0, < 3.0.14; >= 2.1.0, <= 2.16.1
CVE-2026-85717
6.8
1%
Sep 17
AsyncHttpClient: Client-wide realm credentials re-sent to a cross-origin redirect target
Affected: >= 2.14.5, < 2.16.1; >= 3.0.9, < 3.0.12
CVE-2026-40490
6.8
0%
Apr 18
AsyncHttpClient leaks authorization credentials to untrusted domains on cross-origin redirects
Affected: >= 3.0.0.Beta1, < 3.0.9; < 2.14.5
CVE-2026-107285
5.9
0%
Oct 7
AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel
Affected: >= 3.0.0, <3.0.12; >= 2.0.0, < 2.16.1
CVE-2026-85720
5.9
0%
Sep 17
AsyncHttpClient: Origin credentials sent to the proxy on the plaintext CONNECT request
Affected: >= 2.0.0, < 2.16.1; >= 3.0.0, < 3.0.12
CVE-2026-85718
5.9
1%
Sep 17
AsyncHttpClient: Connection permit leak on TLS handshake failure causes per-host denial of service
Affected: >= 3.0.8, < 3.0.12
CVE-2026-102740
5.8
0%
Oct 15
AsyncHttpClient: Resumable download index store is created world-readable and follows a planted symlink
Affected: >= 2.0.0, < 2.16.1; >= 3.0.0, < 3.0.12
CVE-2026-107229
4.0
0%
Oct 7
AsyncHttpClient: Incomplete origin checks in the default cookie store allow cookie tossing onto public-suffix and IP-address hosts
Affected: >= 3.0.11, < 3.0.14; >= 2.16.0, <= 2.16.1
CVE-2026-55688
4.0
0%
Jul 1
AsyncHttpClient: Cookie stored for an unrelated domain (cookie tossing) via ThreadSafeCookieStore
Affected: >= 2.0.0, < 2.16.0; >= 3.0.0.Beta1, < 3.0.11
Showing 11