Vulnerability · Published Sep 17, 2026 · Assigned by GitHub_M
CVE-2026-85716AsyncHttpClient: SCRAM and Digest mutual-authentication responses are not verified
Low 3.7
In plain English
A low-severity improper authentication in async-http-client from AsyncHttpClient. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 3.0.8 until 3.0.12, processScramAuthenticationInfo and processAuthenticationInfo compute the SCRAM ServerSignature or Digest rspauth verification result but log a mismatch and still deliver the response as authenticated. On a non-TLS or compromised transport, a peer that has not proved knowledge of the shared secret can therefore be accepted as the server. The fix rejects a present invalid value and computes Digest rspauth from the Authorization parameters actually sent, but verification remains unenforced when the value is absent, the sent parameters cannot be recovered, or Digest uses qop=auth-int. This issue is fixed in version 3.0.12.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.asynchttpclient:async-http-client | 3.0.12 | GHSA-fj9w-c36g-h5x8 |
| Ubuntu:22.04:LTS | async-http-client | no fix listed | UBUNTU-CVE-2026-85716 |
| Ubuntu:24.04:LTS | async-http-client | no fix listed | UBUNTU-CVE-2026-85716 |
| Ubuntu:26.04:LTS | async-http-client | no fix listed | UBUNTU-CVE-2026-85716 |
| Ubuntu:26.10 | async-http-client | no fix listed | UBUNTU-CVE-2026-85716 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| AsyncHttpClient | async-http-client | >= 3.0.8, < 3.0.12 |
Weakness: CWE-287, CWE-390 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
References
- https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-fj9w-c36g-h5x8 x_refsource_CONFIRM
- https://github.com/AsyncHttpClient/async-http-client/pull/2235 x_refsource_MISC
- https://github.com/AsyncHttpClient/async-http-client/commit/10b3db9910f0bbad2ea3dc7c7553bae12bc4a5e4 x_refsource_MISC
- https://github.com/AsyncHttpClient/async-http-client/commit/685173afea07892462071d966ef6ce5c88cbc66f x_refsource_MISC
- https://github.com/AsyncHttpClient/async-http-client/commit/7fe8700fd5b46c668cee7774624f36b87b9dd32a x_refsource_MISC