The vulnerability lies in PropertiesBasedResumableProcessor being world-readable and following symlinks, allowing local users to read stored download URLs that may include sensitive data and to overwrite arbitrary files writable by the JVM. This is a local privilege escalation and information disclosure problem described by CWE-379, CWE-61, and CWE-732. Based on the description, the exploit requires no network interaction and relies solely on a local account with read or write permission in the system temporary directory.

AsyncHttpClient async-http-client releases from 2.0.0 through 2.16.1, and from 3.0.0 through 3.0.12, are affected. This 3.x range is inferred from the upper bound of 3.0.12, as the lower bound is not explicitly stated. The problem originates in the ResumableAsyncHandler properties store located under $java.io.tmpdir/ahc/. Upgrading to version 2.16.1 or 3.0.12 removes the insecure file creation logic and disables the faulty symlink handling.

Based on the description, the attack vector is local only. The CVSS score of 5.8 indicates moderate severity. The EPSS score of less than 1% suggests that exploitation is currently unlikely, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, a local attacker can observe download URLs and, if they can write to the temporary directory, redirect the client to overwrite critical files. The attack requires the ability to create or delete files in the shared temp directory, so it relies on local system privilege.