Vulnerability · Published Sep 17, 2026 · Assigned by GitHub_M
CVE-2026-85717AsyncHttpClient: Client-wide realm credentials re-sent to a cross-origin redirect target
Medium 6.8
In plain English
A medium-severity information exposure in async-http-client from AsyncHttpClient. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.14.5 to 2.16.0 and from 3.0.9 to 3.0.11, a client configured with a client-wide Realm and redirect following can disclose credentials after a cross-origin redirect because the Interceptors authentication path falls back to the client configuration after redirect handling clears the per-exchange realm. If the attacker-controlled target returns 401, the client can send Basic or Digest credentials or a Negotiate or NTLM token to that origin. Per-request realms are stripped correctly, and this issue is a residual bypass of the earlier cross-origin credential-stripping fixes. This issue is fixed in versions 2.16.1 and 3.0.12.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.asynchttpclient:async-http-client | 3.0.12 | GHSA-f8m2-889x-vw4x |
| Maven | org.asynchttpclient:async-http-client | 2.16.1 | GHSA-f8m2-889x-vw4x |
| Ubuntu:22.04:LTS | async-http-client | no fix listed | UBUNTU-CVE-2026-85717 |
| Ubuntu:24.04:LTS | async-http-client | no fix listed | UBUNTU-CVE-2026-85717 |
| Ubuntu:26.04:LTS | async-http-client | no fix listed | UBUNTU-CVE-2026-85717 |
| Ubuntu:26.10 | async-http-client | no fix listed | UBUNTU-CVE-2026-85717 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| AsyncHttpClient | async-http-client | >= 2.14.5, < 2.16.1>= 3.0.9, < 3.0.12 |
Weakness: CWE-200, CWE-522 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
References
- https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-f8m2-889x-vw4x x_refsource_CONFIRM
- https://github.com/AsyncHttpClient/async-http-client/pull/2224 x_refsource_MISC
- https://github.com/AsyncHttpClient/async-http-client/commit/43db7bba81430cbd61ec2dc2c7be464e0ff6a0ff x_refsource_MISC
- https://github.com/AsyncHttpClient/async-http-client/commit/b66757bec34def2e9867bb2b77bd848b1112abb4 x_refsource_MISC