Description
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, cross-host request replay updates the current request but leaves the target request and related proxy context pointing at the original origin. Connection-pool selection, CONNECT handling, realm selection, and TLS setup can consequently send the original host's path, Host header, Authorization credentials, or plaintext request to the replay destination. Documented ResponseFilter failover and retry paths can trigger the replay. This issue is fixed in versions 3.0.13 and 2.16.1.
Published: 2026-10-07
Score: 9.4 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Credential Disclosure
Action: Patch
AI Analysis

Impact

The AsyncHttpClient library contains a flaw where cross-host request replay updates the request but leaves the target request and proxy context pointing at the original origin. As a result, the replayed request may transmit the original host’s path, Host header, authorization credentials, or plaintext data to the new host. This vulnerability enables unintended disclosure of credentials and other sensitive data and is categorized as improper authentication handling (CWE-201, CWE-319, CWE-441, CWE-522).

Affected Systems

Applications using AsyncHttpClient versions earlier than 3.0.13 and 2.16.1 are affected. Any Java application that incorporates the library without updating may unintentionally send requests and credentials to third-party hosts during retry or failover paths executed by the library.

Risk and Exploitability

The vulnerability carries a CVSS score of 9.4, reflecting very high severity, yet its current EPSS score is below 1%, indicating a low likelihood of exploitation at the time of this analysis. The issue is not listed in the CISA KEV catalog. Attackers could trigger the flaw by controlling a target host or manipulating the application network, causing the application to replay a request to an unintended host and leak credentials or plaintext data. Because the flaw can be triggered during response filter failover or retry paths, a threat actor could coerce the victim application into sending sensitive information to a malicious server.

Generated by OpenCVE AI on October 10, 2026 at 01:55 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade AsyncHttpClient to version 2.16.1 or 3.0.13 and later.
  • Disable or remove cross-host request replay and retry mechanisms if the application does not require them.
  • Add network safeguards to block requests containing Host headers or Authorization credentials to untrusted destinations and audit outbound traffic for unexpected credential leakage.

Generated by OpenCVE AI on October 10, 2026 at 01:55 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-jmqq-x5g9-9p2w AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host
History

Sat, 10 Oct 2026 03:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Sat, 10 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-201
References
Metrics threat_severity

None

 cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N'}

threat_severity

Critical

Fri, 09 Oct 2026 07:45:00 +0000

Type Values Removed Values Added
First Time appeared Asynchttpclient Project
Asynchttpclient Project async-http-client
Vendors & Products Asynchttpclient Project
Asynchttpclient Project async-http-client

Wed, 07 Oct 2026 21:45:00 +0000

Type Values Removed Values Added
Description The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, cross-host request replay updates the current request but leaves the target request and related proxy context pointing at the original origin. Connection-pool selection, CONNECT handling, realm selection, and TLS setup can consequently send the original host's path, Host header, Authorization credentials, or plaintext request to the replay destination. Documented ResponseFilter failover and retry paths can trigger the replay. This issue is fixed in versions 3.0.13 and 2.16.1.
Title AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host
Weaknesses CWE-319
CWE-441
CWE-522
References
Metrics cvssV4_0

{'score': 9.4, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N'}

Subscriptions

Asynchttpclient Project Async-http-client
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-10T02:50:16.635Z

Reserved: 2026-10-07T15:53:23.585Z

Link: CVE-2026-107282

cve-icon Vulnrichment

Updated: 2026-10-10T02:50:12.866Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-07T22:17:04.167

Modified: 2026-10-10T03:17:06.900

Link: CVE-2026-107282

cve-icon Redhat

Severity : Critical

Publid Date: 2026-10-07T21:21:29Z

Links: CVE-2026-107282 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-10T02:00:11Z

Weaknesses
  • CWE-201

    Insertion of Sensitive Information Into Sent Data

  • CWE-319

    Cleartext Transmission of Sensitive Information

  • CWE-441

    Unintended Proxy or Intermediary ('Confused Deputy')

  • CWE-522

    Insufficiently Protected Credentials