Vulnerability · Published Oct 7, 2026 · Assigned by GitHub_M

CVE-2026-107285AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel

Medium 5.9

In plain English

A medium-severity security flaw in async-http-client from AsyncHttpClient. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.9Medium

Exploit odds (30 days)0.2%top 89.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, a proxied ws request is carried through CONNECT, but NettyRequestFactory.newNettyRequest and requestUri decide whether to attach proxy authentication and an absolute-form target only from whether the URI is secure. Because ws is not marked secure, the tunneled WebSocket upgrade sent to the origin includes the proxy's Proxy-Authorization value. Basic credentials are directly recoverable and Digest responses can be replayed or cracked offline. This issue is fixed in versions 3.0.12 and 2.16.1.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	async-http-client	no fix listed	DEBIAN-CVE-2026-107285
Maven	org.asynchttpclient:async-http-client	3.0.12	GHSA-3wp9-xfwm-rjjf
Maven	org.asynchttpclient:async-http-client	2.16.1	GHSA-3wp9-xfwm-rjjf
Ubuntu:22.04:LTS	async-http-client	no fix listed	UBUNTU-CVE-2026-107285
Ubuntu:24.04:LTS	async-http-client	no fix listed	UBUNTU-CVE-2026-107285
Ubuntu:26.04:LTS	async-http-client	no fix listed	UBUNTU-CVE-2026-107285
Ubuntu:26.10	async-http-client	no fix listed	UBUNTU-CVE-2026-107285

Affected products (as reported)

Vendor	Product	Versions
AsyncHttpClient	async-http-client	>= 3.0.0, <3.0.12>= 2.0.0, < 2.16.1

Weakness: CWE-319, CWE-522 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References

https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-3wp9-xfwm-rjjf x_refsource_CONFIRM
https://github.com/AsyncHttpClient/async-http-client/commit/6e9cb75a9b7259353f983fc90ca28b1da3742e18 x_refsource_MISC
https://github.com/AsyncHttpClient/async-http-client/commit/c4feab0f7f86d61505a48e40d383c8a375a22e18 x_refsource_MISC
https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-2.16.1 x_refsource_MISC
https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.12 x_refsource_MISC