CVE-2026-107231 in AsyncHttpClient
Summary
by MITRE • 10/08/2026
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, Realm.Builder treats a Digest challenge that yields no usable nonce as a Basic challenge. A malicious origin or proxy can label a challenge Digest while omitting or emptying the nonce, causing the client to resend the username and password using reversible Basic authentication. Both origin and proxy challenge parsers are affected. This issue is fixed in versions 3.0.13 and 2.16.1.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/08/2026
The AsyncHttpClient library serves as a critical component for Java-based applications requiring efficient execution of HTTP requests and asynchronous processing of responses. Within this ecosystem, the handling of authentication challenges represents a sensitive area where protocol compliance directly impacts security posture. Specifically, the Realm.Builder class is responsible for parsing server-side authentication challenges to determine the appropriate method for credential transmission. A significant logical flaw exists in how this component processes Digest authentication challenges that lack essential parameters, creating a pathway for unauthorized access through protocol downgrade attacks.
The core technical vulnerability lies in the conditional logic used by Realm.Builder when encountering an HTTP 401 Unauthorized response with a WWW-Authenticate header indicating Digest authentication. According to RFC standards, a valid Digest challenge must include a nonce value, which is crucial for preventing replay attacks and ensuring session uniqueness. However, prior to versions 3.0.13 and 2.16.1, the library fails to validate the presence of this nonce. If an attacker or misconfigured proxy provides a Digest challenge with an empty or missing nonce parameter, the client incorrectly interprets this malformed request as a Basic authentication challenge rather than rejecting it or requesting proper credentials via Digest. This logic error effectively bypasses the security mechanisms inherent in Digest authentication.
This flaw enables a man-in-the-middle attack scenario where a malicious origin server or intermediate proxy can force the client to transmit credentials using Basic authentication instead of Digest. While Digest authentication utilizes cryptographic hashing and nonces to protect credential integrity, Basic authentication transmits usernames and passwords encoded only with Base64 encoding, which is easily reversible. Consequently, any network observer capable of intercepting traffic during this forced downgrade can decode the transmitted username and password in plaintext. This exposure compromises user confidentiality and allows attackers to hijack sessions or escalate privileges by reusing these stolen credentials against other services where users may have employed identical passwords.
The operational impact extends beyond simple credential theft. By exploiting this vulnerability, an attacker can degrade the security level of a communication channel without requiring complex cryptographic breaks. The attack is particularly insidious because it relies on protocol ambiguity and implementation errors rather than weaknesses in encryption algorithms themselves. Both the origin server challenge parser and proxy challenge parsers are susceptible to manipulation if they fail to enforce strict adherence to RFC 7616, which mandates that Digest challenges must contain a nonce attribute. This affects any application relying on AsyncHttpClient for secure API interactions or web service consumption where authentication is required.
Mitigation strategies primarily involve upgrading the library to version 3.0.13 or 2.16.1 and later, where this logic error has been corrected to strictly enforce Digest protocol requirements. In addition to software updates, developers should implement defense-in-depth measures such as enforcing HTTPS with strict certificate validation to prevent man-in-the-middle attacks that facilitate the initial challenge manipulation. Furthermore, applications can be configured to reject Basic authentication entirely if only Digest is expected by the backend services, adding an additional layer of protection against protocol downgrade attempts. Monitoring for unusual patterns in HTTP 401 responses and nonce values can also aid in detecting active exploitation attempts in production environments.
From a classification perspective, this vulnerability aligns with CWE-287, which describes Improper Authentication, specifically involving the failure to correctly identify or authenticate entities due to logic errors. It is also relevant to CWE-693, Protection Mechanism Failure, as the security control designed to protect credentials fails under specific input conditions. In terms of adversary tactics, this flaw supports techniques associated with MITMATTACK01 in the ATT&CK framework, where attackers intercept and modify communications to steal sensitive data or bypass authentication controls. Understanding these classifications helps organizations prioritize remediation efforts based on standard risk assessment frameworks.