CVE-2026-85716

The AsyncHttpClient (AHC) library versions 2.0.0 to 2.16.1 and 3.0.12 can leak origin credentials when using an HTTP proxy to reach an HTTPS origin. NettyRequestFactory and NettyRequestSender.sendRequestWithNewChannel attach Authorization to the plaintext CONNECT request before the TLS tunnel exists, exposing Basic or Digest credentials and per-connection NTLM, Kerberos, or SPNEGO tokens to the proxy and observers on the client-to-proxy hop.

The AsyncHttpClient (AHC) library in versions from 2.0.0 until 2.16.1 and 3.0.12 installs the HTTP/1.1 response decompressor without a cumulative output-size limit. A hostile or compromised server can send a small gzip, deflate, or snappy response that expands across chunks until the client exhausts its heap and raises OutOfMemoryError. Brotli and zstd are also affected, and in versions 3.0.8 through 3.0.10 the HTTP/2 decompressor is unbounded as well.

The AsyncHttpClient (AHC) library in versions from 2.1.0 until 2.16.1 and 3.0.12 can expose authenticated SOCKS proxy credentials to the origin server. The Proxy-Authorization header is attached without confirming the request is sent to an HTTP proxy, so preemptive authentication leaks plaintext credentials, and with the default flow a hostile origin can force NTLM, Kerberos, or SPNEGO credentials through the SOCKS tunnel via a 407 response.

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 3.0.8 until 3.0.12, a client with maxConnections or maxConnectionsPerHost set above zero leaks one connection permit whenever TLS connection establishment fails before the handshake completes. NettyConnectListener removes the partitionKeyLock permit from NettyResponseFuture before every failure path is bound to the channel closeFuture, so an abort can leave the permit unreleased. Repeated failures can permanently lock out one host under a per-host limit or drain the shared pool under a global limit, blocking later requests even when no connection remains open. The default unlimited connection setting is not affected. This issue is fixed in version 3.0.12.

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.14.5 to 2.16.0 and from 3.0.9 to 3.0.11, a client configured with a client-wide Realm and redirect following can disclose credentials after a cross-origin redirect because the Interceptors authentication path falls back to the client configuration after redirect handling clears the per-exchange realm. If the attacker-controlled target returns 401, the client can send Basic or Digest credentials or a Negotiate or NTLM token to that origin. Per-request realms are stripped correctly, and this issue is a residual bypass of the earlier cross-origin credential-stripping fixes. This issue is fixed in versions 2.16.1 and 3.0.12.

The AsyncHttpClient (AHC) library versions 2.0.0 through 2.15.0 and 3.0.0.Beta1 through 3.0.10 have a vulnerability in ThreadSafeCookieStore that does not verify whether the responding host is allowed to set a cookie for a domain. This allows an attacker-controlled host to inject a cookie for an unrelated domain, which the client then sends to that domain.

The AsyncHttpClient (AHC) library versions 2.x before 2.15.0 and 3.x before 3.0.10 leak Cookie headers to cross-origin redirect targets. During a redirect to a different origin, the Cookie header is not stripped, allowing session cookies to be sent to attacker-controlled servers. Fixed in versions 2.15.0 and 3.0.10.