CVE-2026-102740 in async-http-client
Summary
by MITRE • 10/15/2026
The AsyncHttpClient library allows Java applications to execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 and 3.0.12, PropertiesBasedResumableProcessor stores resumable download state at the predictable shared path $java.io.tmpdir/ahc/ResumableAsyncHandler.properties with default permissions and link-following file operations. A local user who can read the shared store can see download URLs, including embedded user information or query tokens. A local user who can write within or pre-create the affected shared store directory can plant a symbolic link that the client follows when saving state, truncating and overwriting a target file writable by the client process. The filesystem path is used when ResumableAsyncHandler decorates another AsyncHandler, while the no-argument constructors use a no-op processor and are unaffected. This issue is fixed in versions 2.16.1 and 3.0.12.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The Asynchronous Http Client library for Java provides functionality to execute HTTP requests and process responses asynchronously, facilitating efficient network operations within enterprise applications. A critical security flaw exists within the PropertiesBasedResumableProcessor component in versions ranging from 2.0.0 up to 2.16.1 and version 3.0.12 of this library. This vulnerability stems from an insecure handling of temporary files used for storing resumable download state, specifically involving predictable file paths and insufficient access controls that expose sensitive data and allow for local privilege escalation through filesystem manipulation.
The core technical flaw involves the storage location and permissions associated with the ResumableAsyncHandler.properties file. By default, this file is created in a shared temporary directory determined by the system property java.io.tmpdir under an ahc subdirectory. The application fails to enforce restrictive file permissions on this state store, leaving it accessible to other local users on the same host. Furthermore, the implementation does not adequately mitigate risks associated with symbolic link following during file operations. When the ResumableAsyncHandler is instantiated using constructors that invoke PropertiesBasedResumableProcessor rather than no-argument constructors which utilize a no-op processor, the application becomes susceptible to these filesystem-based attacks.
From an information disclosure perspective, any local user with read access to the shared temporary directory can inspect the contents of the properties file. This file contains state data for resumable downloads, including full download URLs that may embed sensitive user credentials, authentication tokens, or session identifiers in query parameters. The exposure of these elements allows attackers to perform credential theft or session hijacking by simply reading the local filesystem, bypassing network-based security controls since the attack vector is strictly local.
Beyond information leakage, the vulnerability presents a significant risk for arbitrary file overwrite and potential remote code execution depending on the target application's context. A malicious local user who possesses write permissions to the shared temporary directory or can pre-create files within it can exploit the lack of atomicity in file creation by planting a symbolic link named ResumableAsyncHandler.properties that points to an arbitrary system file writable by the client process, such as /etc/passwd on Unix-like systems or critical application configuration files. When the vulnerable library attempts to save its state, it follows this symlink and truncates or overwrites the target file. This behavior aligns with CWE-59 Improper Link Resolution Before File Access and CWE-377 Insecure Temporary File, representing a classic race condition or link-following vulnerability that compromises data integrity and system stability.
The operational impact of this vulnerability is severe for multi-user environments where local users may have varying levels of trust but share the same temporary directory space. Attackers can leverage this flaw to disrupt service availability by corrupting critical files, steal sensitive authentication material embedded in URLs, or escalate privileges if they can overwrite executable scripts or configuration files that are subsequently executed with higher privileges. The vulnerability is particularly dangerous because it relies on default configurations and common development patterns where developers assume temporary directories are secure sandboxes, which is often not the case in shared hosting or containerized environments.
To mitigate this risk, organizations must upgrade to version 2.16.1 or later of the AsyncHttpClient library, as these versions address the insecure file handling mechanisms. In addition to upgrading, application developers should ensure that any custom implementations of resumable download handlers adhere to secure coding standards by using private temporary directories with restrictive permissions (such as mode 700) and avoiding predictable filenames in shared spaces. Implementing atomic file operations or writing directly to a unique, non-symlinked path further reduces the attack surface. Security teams should also audit existing deployments for usage of vulnerable constructors that trigger PropertiesBasedResumableProcessor and verify that no sensitive data is embedded in URL query parameters used by these handlers. This remediation strategy aligns with ATT&CK techniques related to Local File Access and Defense Evasion via symlink manipulation, ensuring robust protection against local filesystem attacks.