CVE-2026-107231

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, the HTTP/1.1 connection-pool key excludes the authenticated principal for connection-oriented NTLM and Negotiate authentication. A pooled socket authenticated for one request can be reused by a request carrying another principal, and the server executes that later request as the first identity. Basic and Digest are not affected because they authenticate each request. This issue is fixed in versions 3.0.13 and 2.16.1.

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. In 3.0.12, a peer offering only Digest qop=auth-int causes mutual-authentication verification to be skipped. AuthenticatorUtils.computeExpectedRspAuth returns no expected value for auth-int, and Interceptors treats that result as unverifiable but nonfatal, so a response with an invalid rspauth value is accepted. A peer that does not know the shared secret can therefore be accepted as the authenticated server. This issue is fixed in version 3.0.13.

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 on 3.x and 2.16.1 on 2.x, the client infers that an HTTP proxy tunnel exists from the last request method rather than the CONNECT result. After a proxy rejects CONNECT, redirect or authentication handlers can write an origin request and its Authorization credentials onto the still-plaintext proxy connection. Basic credentials can be recovered directly, while NTLM responses may be cracked or relayed. This issue is fixed in versions 3.0.12 and 2.16.1.

The AsyncHttpClient (AHC) library versions 2.0.0 through 3.0.14 incorrectly partition the connection pool for Kerberos, SPNEGO, NTLM, and authenticated proxy connections. Missing identity-defining fields can allow reuse of a socket authenticated as a different identity, leading to a request being executed under the first identity and exposing its data or authority to another caller. This issue is fixed in version 3.0.14.

The AsyncHttpClient (AHC) library versions 2.2.0 through 3.0.14 have unbounded WebSocket permessage-deflate decompression when compression is enabled. The inbound pipeline aggregates compressed frames before WebSocketClientCompressionHandler inflates them, so webSocketMaxFrameSize and webSocketMaxBufferSize do not bound decompressed output. A malicious WebSocket peer can send a small compressed message that expands to a very large Netty buffer and exhausts JVM heap. This issue is fixed in version 3.0.14.

Vulnerability in AsyncHttpClient (AHC) library before versions 3.0.13 and 2.16.1 allows cross-host request replay that updates the current request but leaves the target request and proxy context pointing to the original origin. This can send the original host's path, Host header, Authorization credentials, or plaintext request to the replay destination.

The AsyncHttpClient (AHC) library versions 2.0.0 to 2.16.1 and 3.0.12 can leak origin credentials when using an HTTP proxy to reach an HTTPS origin. NettyRequestFactory and NettyRequestSender.sendRequestWithNewChannel attach Authorization to the plaintext CONNECT request before the TLS tunnel exists, exposing Basic or Digest credentials and per-connection NTLM, Kerberos, or SPNEGO tokens to the proxy and observers on the client-to-proxy hop.

The AsyncHttpClient (AHC) library in versions 3.0.8 through 3.0.12 does not enforce verification of SCRAM ServerSignature and Digest rspauth authentication results. On a non-TLS or compromised transport, an attacker can be accepted as the server without proving knowledge of the shared secret. The issue is fixed in version 3.0.12.

The AsyncHttpClient (AHC) library in versions from 2.0.0 until 2.16.1 and 3.0.12 installs the HTTP/1.1 response decompressor without a cumulative output-size limit. A hostile or compromised server can send a small gzip, deflate, or snappy response that expands across chunks until the client exhausts its heap and raises OutOfMemoryError. Brotli and zstd are also affected, and in versions 3.0.8 through 3.0.10 the HTTP/2 decompressor is unbounded as well.

The AsyncHttpClient (AHC) library in versions from 2.1.0 until 2.16.1 and 3.0.12 can expose authenticated SOCKS proxy credentials to the origin server. The Proxy-Authorization header is attached without confirming the request is sent to an HTTP proxy, so preemptive authentication leaks plaintext credentials, and with the default flow a hostile origin can force NTLM, Kerberos, or SPNEGO credentials through the SOCKS tunnel via a 407 response.