Log in Start free

Vulnerability · Published Oct 7, 2026 · Assigned by GitHub_M

CVE-2026-107284AsyncHttpClient: WebSocket handshake continues after a failed Sec-WebSocket-Accept check

Low 3.7

In plain English

A low-severity insufficient verification of data authenticity in async-http-client from AsyncHttpClient. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).

Severity (CVSS 3.1)3.7Low
Exploit odds (30 days)0.1%top 96.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, WebSocketHandler.upgrade aborts a handshake whose Sec-WebSocket-Accept value is missing or invalid but continues into pipeline installation and onOpen delivery. Frames coalesced with the invalid 101 response can be decoded and delivered from a peer that did not prove the handshake, although the request future fails and the channel closes. This issue is fixed in versions 3.0.12 and 2.16.1.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12async-http-clientno fix listedDEBIAN-CVE-2026-107284
Ubuntu:22.04:LTSasync-http-clientno fix listedUBUNTU-CVE-2026-107284
Ubuntu:24.04:LTSasync-http-clientno fix listedUBUNTU-CVE-2026-107284
Ubuntu:26.04:LTSasync-http-clientno fix listedUBUNTU-CVE-2026-107284
Ubuntu:26.10async-http-clientno fix listedUBUNTU-CVE-2026-107284

Affected products (as reported)

VendorProductVersions
AsyncHttpClient async-http-client >= 3.0.0, < 3.0.12>= 2.0.0, < 2.16.1

Weakness: CWE-345, CWE-670 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

References