CVE-2026-85718
MediumCVSS 5.9Summary
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 3.0.8 until 3.0.12, a client with maxConnections or maxConnectionsPerHost set above zero leaks one connection permit whenever TLS connection establishment fails before the handshake completes. NettyConnectListener removes the partitionKeyLock permit from NettyResponseFuture before every failure path is bound to the channel closeFuture, so an abort can leave the permit unreleased. Repeated failures can permanently lock out one host under a per-host limit or drain the shared pool under a global limit, blocking later requests even when no connection remains open. The default unlimited connection setting is not affected. This issue is fixed in version 3.0.12.
Risk Assessment
The risk is the possibility of exhausting the connection pool, which could lead to service unavailability for clients using connection limits.
Recommendation
It is recommended to update the AsyncHttpClient library to version 3.0.12 or later, which includes a fix for the permit leak.
Other vulnerabilities in AsyncHttpClient
See all- CVE-2026-85720Medium
The AsyncHttpClient (AHC) library versions 2.0.0 to 2.16.1 and 3.0.12 can leak origin credentials when using an HTTP proxy to reach an HTTPS origin. NettyRequestFactory and NettyRequestSender.sendRequestWithNewChannel attach Authorization to the plaintext CONNECT request before the TLS tunnel exists, exposing Basic or Digest credentials and per-connection NTLM, Kerberos, or SPNEGO tokens to the proxy and observers on the client-to-proxy hop.
- CVE-2026-85716Low
The AsyncHttpClient (AHC) library in versions 3.0.8 through 3.0.12 does not enforce verification of SCRAM ServerSignature and Digest rspauth authentication results. On a non-TLS or compromised transport, an attacker can be accepted as the server without proving knowledge of the shared secret. The issue is fixed in version 3.0.12.
- CVE-2026-85721High
The AsyncHttpClient (AHC) library in versions from 2.0.0 until 2.16.1 and 3.0.12 installs the HTTP/1.1 response decompressor without a cumulative output-size limit. A hostile or compromised server can send a small gzip, deflate, or snappy response that expands across chunks until the client exhausts its heap and raises OutOfMemoryError. Brotli and zstd are also affected, and in versions 3.0.8 through 3.0.10 the HTTP/2 decompressor is unbounded as well.
- CVE-2026-85719High
The AsyncHttpClient (AHC) library in versions from 2.1.0 until 2.16.1 and 3.0.12 can expose authenticated SOCKS proxy credentials to the origin server. The Proxy-Authorization header is attached without confirming the request is sent to an HTTP proxy, so preemptive authentication leaks plaintext credentials, and with the default flow a hostile origin can force NTLM, Kerberos, or SPNEGO credentials through the SOCKS tunnel via a 407 response.
- CVE-2026-85717Medium
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.14.5 to 2.16.0 and from 3.0.9 to 3.0.11, a client configured with a client-wide Realm and redirect following can disclose credentials after a cross-origin redirect because the Interceptors authentication path falls back to the client configuration after redirect handling clears the per-exchange realm. If the attacker-controlled target returns 401, the client can send Basic or Digest credentials or a Negotiate or NTLM token to that origin. Per-request realms are stripped correctly, and this issue is a residual bypass of the earlier cross-origin credential-stripping fixes. This issue is fixed in versions 2.16.1 and 3.0.12.
- CVE-2026-55688Medium
The AsyncHttpClient (AHC) library versions 2.0.0 through 2.15.0 and 3.0.0.Beta1 through 3.0.10 have a vulnerability in ThreadSafeCookieStore that does not verify whether the responding host is allowed to set a cookie for a domain. This allows an attacker-controlled host to inject a cookie for an unrelated domain, which the client then sends to that domain.
- CVE-2026-45300High
The AsyncHttpClient (AHC) library versions 2.x before 2.15.0 and 3.x before 3.0.10 leak Cookie headers to cross-origin redirect targets. During a redirect to a different origin, the Cookie header is not stripped, allowing session cookies to be sent to attacker-controlled servers. Fixed in versions 2.15.0 and 3.0.10.
Original NVD description (English source)
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 3.0.8 until 3.0.12, a client with maxConnections or maxConnectionsPerHost set above zero leaks one connection permit whenever TLS connection establishment fails before the handshake completes. NettyConnectListener removes the partitionKeyLock permit from NettyResponseFuture before every failure path is bound to the channel closeFuture, so an abort can leave the permit unreleased. Repeated failures can permanently lock out one host under a per-host limit or drain the shared pool under a global limit, blocking later requests even when no connection remains open. The default unlimited connection setting is not affected. This issue is fixed in version 3.0.12.