AS
Vendor
AsyncHttpClient
24
CVEs
0
On KEV
15
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-102740 | AS async-http-client AsyncHttpClient | 5.8 | Oct 15 | AsyncHttpClient: Resumable download index store is created world-readable and follows a planted symlink |
| CVE-2026-107226 | AS async-http-client AsyncHttpClient | 6.8 | Oct 12 | AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPS |
| CVE-2026-107285 | AS async-http-client AsyncHttpClient | 5.9 | Oct 7 | AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel |
| CVE-2026-107284 | AS async-http-client AsyncHttpClient | 3.7 | Oct 7 | AsyncHttpClient: WebSocket handshake continues after a failed Sec-WebSocket-Accept check |
| CVE-2026-107283 | AS async-http-client AsyncHttpClient | 3.7 | Oct 7 | AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random source |
| CVE-2026-107282 | AS async-http-client AsyncHttpClient | 9.4 | Oct 7 | AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host |
| CVE-2026-107281 | AS async-http-client AsyncHttpClient | 7.6 | Oct 7 | AsyncHttpClient: Connection pool key omits the authenticated principal, so an NTLM or Negotiate connection is reused across identities |
| CVE-2026-107280 | AS async-http-client AsyncHttpClient | 6.9 | Oct 7 | AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.uk |
| CVE-2026-107279 | AS async-http-client AsyncHttpClient | 8.8 | Oct 7 | AsyncHttpClient: Digest mutual authentication is switched off by a peer offering qop=auth-int |
| CVE-2026-107232 | AS async-http-client AsyncHttpClient | 7.5 | Oct 7 | AsyncHttpClient: Origin credentials sent in cleartext to a proxy that rejects the CONNECT |
| CVE-2026-107231 | AS async-http-client AsyncHttpClient | 8.7 | Oct 7 | AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext |
| CVE-2026-107230 | AS async-http-client AsyncHttpClient | 7.4 | Oct 7 | AsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy logins |
| CVE-2026-107229 | AS async-http-client AsyncHttpClient | 4.0 | Oct 7 | AsyncHttpClient: Incomplete origin checks in the default cookie store allow cookie tossing onto public-suffix and IP-address hosts |
| CVE-2026-107228 | AS async-http-client AsyncHttpClient | 6.8 | Oct 7 | AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader (Bypass of CVE-2024-53990 Fix) |
| CVE-2026-107227 | AS async-http-client AsyncHttpClient | 7.5 | Oct 7 | AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabled |
| CVE-2026-85716 | AS async-http-client AsyncHttpClient | 3.7 | Sep 17 | AsyncHttpClient: SCRAM and Digest mutual-authentication responses are not verified |
| CVE-2026-85720 | AS async-http-client AsyncHttpClient | 5.9 | Sep 17 | AsyncHttpClient: Origin credentials sent to the proxy on the plaintext CONNECT request |
| CVE-2026-85718 | AS async-http-client AsyncHttpClient | 5.9 | Sep 17 | AsyncHttpClient: Connection permit leak on TLS handshake failure causes per-host denial of service |
| CVE-2026-85721 | AS async-http-client AsyncHttpClient | 7.5 | Sep 17 | AsyncHttpClient: Unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of service |
| CVE-2026-85717 | AS async-http-client AsyncHttpClient | 6.8 | Sep 17 | AsyncHttpClient: Client-wide realm credentials re-sent to a cross-origin redirect target |
| CVE-2026-85719 | AS async-http-client AsyncHttpClient | 7.5 | Sep 17 | AsyncHttpClient: SOCKS proxy credentials sent to the origin server over plaintext HTTP |
| CVE-2026-55688 | AS async-http-client AsyncHttpClient | 4.0 | Jul 1 | AsyncHttpClient: Cookie stored for an unrelated domain (cookie tossing) via ThreadSafeCookieStore |
| CVE-2026-45300 | AS async-http-client AsyncHttpClient | 7.4 | Jun 5 | async-http-client: Cookie header not stripped on cross-origin redirect |
| CVE-2026-40490 | AS async-http-client AsyncHttpClient | 6.8 | Apr 18 | AsyncHttpClient leaks authorization credentials to untrusted domains on cross-origin redirects |