Log in Start free

Vulnerability · Published Oct 7, 2026 · Assigned by GitHub_M

CVE-2026-107281AsyncHttpClient: Connection pool key omits the authenticated principal, so an NTLM or Negotiate connection is reused across identities

High 7.6

In plain English

A high-severity incorrect authorization in async-http-client from AsyncHttpClient. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).

Severity (CVSS 4.0)7.6High
Exploit odds (30 days)0.2%top 93.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, the HTTP/1.1 connection-pool key excludes the authenticated principal for connection-oriented NTLM and Negotiate authentication. A pooled socket authenticated for one request can be reused by a request carrying another principal, and the server executes that later request as the first identity. Basic and Digest are not affected because they authenticate each request. This issue is fixed in versions 3.0.13 and 2.16.1.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12async-http-clientno fix listedDEBIAN-CVE-2026-107281
Ubuntu:22.04:LTSasync-http-clientno fix listedUBUNTU-CVE-2026-107281
Ubuntu:24.04:LTSasync-http-clientno fix listedUBUNTU-CVE-2026-107281
Ubuntu:26.04:LTSasync-http-clientno fix listedUBUNTU-CVE-2026-107281
Ubuntu:26.10async-http-clientno fix listedUBUNTU-CVE-2026-107281

Affected products (as reported)

VendorProductVersions
AsyncHttpClient async-http-client >= 3.0.0, < 3.0.13>= 2.0.0, < 2.16.1

Weakness: CWE-346, CWE-863 · Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References