The AsyncHttpClient library incorrectly partitions connection pools by ignoring identity‑defining fields for Kerberos, SPNEGO, NTLM, and proxy authentication. When a socket is authenticated as one user, the library may later reuse that socket for another request that also uses authentication, causing the request to be processed under the original identity. This can allow a caller to access data or perform actions that belong to the first identity, leading to accidental credential misuse and information disclosure. The flaw is captured by CWE‑346, CWE‑488 and CWE‑863.

Any Java application that links AsyncHttpClient between versions 2.0.0 and 3.0.14 and performs HTTP requests with Kerberos, SPNEGO, NTLM, or authenticated proxy protocols is affected. The vulnerability resides in the library itself rather than in a specific external product.

The CVSS score of 7.4 indicates high severity. The EPSS score of <1% means exploitation probability is low. The vulnerability is not listed in CISA’s KEV catalog. An attacker can potentially trigger the flaw by making an HTTP request through the affected library that re‑uses a previously authenticated socket belonging to a different identity. Since the vulnerability does not require modifying application code, it can be exploited by normal client traffic if the application uses connection pooling for these authentication schemes.