Vulnerability · Published Oct 7, 2026 · Assigned by GitHub_M
CVE-2026-107282AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host
Critical 9.4
In plain English
A critical-severity security flaw in async-http-client from AsyncHttpClient. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, cross-host request replay updates the current request but leaves the target request and related proxy context pointing at the original origin. Connection-pool selection, CONNECT handling, realm selection, and TLS setup can consequently send the original host's path, Host header, Authorization credentials, or plaintext request to the replay destination. Documented ResponseFilter failover and retry paths can trigger the replay. This issue is fixed in versions 3.0.13 and 2.16.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | async-http-client | no fix listed | DEBIAN-CVE-2026-107282 |
| Maven | org.asynchttpclient:async-http-client | 3.0.13 | GHSA-jmqq-x5g9-9p2w |
| Maven | org.asynchttpclient:async-http-client | 2.16.1 | GHSA-jmqq-x5g9-9p2w |
| Ubuntu:22.04:LTS | async-http-client | no fix listed | UBUNTU-CVE-2026-107282 |
| Ubuntu:24.04:LTS | async-http-client | no fix listed | UBUNTU-CVE-2026-107282 |
| Ubuntu:26.04:LTS | async-http-client | no fix listed | UBUNTU-CVE-2026-107282 |
| Ubuntu:26.10 | async-http-client | no fix listed | UBUNTU-CVE-2026-107282 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| AsyncHttpClient | async-http-client | >= 3.0.0, < 3.0.13>= 2.0.0, < 2.16.1 |
Weakness: CWE-319, CWE-441, CWE-522 · Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
References
- https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-jmqq-x5g9-9p2w x_refsource_CONFIRM
- https://github.com/AsyncHttpClient/async-http-client/commit/15b254514a411623e5f1d8c99ea79c0f82f8a466 x_refsource_MISC
- https://github.com/AsyncHttpClient/async-http-client/commit/bbc31aed3b044f9f7a126cf689a8c8d7ad2ae1cb x_refsource_MISC
- https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-2.16.1 x_refsource_MISC
- https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.13 x_refsource_MISC