CVE-2026-107232 in async-http-client
Summary
by MITRE • 10/07/2026
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 on 3.x and 2.16.1 on 2.x, the client infers that an HTTP proxy tunnel exists from the last request method rather than the CONNECT result. After a proxy rejects CONNECT, redirect or authentication handlers can write an origin request and its Authorization credentials onto the still-plaintext proxy connection. Basic credentials can be recovered directly, while NTLM responses may be cracked or relayed. This issue is fixed in versions 3.0.12 and 2.16.1.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/07/2026
The AsyncHttpClient library serves as a critical component for Java-based applications requiring efficient execution of HTTP requests and asynchronous processing of responses. A significant security flaw was identified within the proxy tunneling logic, specifically affecting versions prior to 3.0.12 in the 3.x branch and prior to 2.16.1 in the 2.x branch. The vulnerability stems from an incorrect inference mechanism used by the client to determine whether a secure HTTP CONNECT tunnel has been successfully established with an intermediate proxy server. Instead of verifying the actual result code returned by the proxy after issuing a CONNECT request, the library erroneously relies on the method type of the last sent request to assume that the tunnel is active and encrypted. This logical error creates a critical gap in the security boundary between the client application and the backend origin servers when operating through an HTTP proxy.
When a proxy server rejects the initial CONNECT request due to authentication failures, access control restrictions, or other policy violations, it typically returns an error status code such as 407 Proxy Authentication Required or 403 Forbidden. Under normal secure operations, subsequent requests should be blocked or handled appropriately given that no encrypted tunnel exists. However, due to the vulnerability described, AsyncHttpClient proceeds with the assumption that a plaintext connection is still being treated as a secured tunnel. Consequently, redirect handlers and authentication handlers may proceed to write origin-specific HTTP requests directly onto this unencrypted proxy connection. This behavior bypasses the intended security controls of the proxy infrastructure, allowing sensitive data to traverse an insecure channel where it can be intercepted by network attackers or malicious proxies situated between the client and the destination server.
The operational impact of this vulnerability is severe, particularly regarding credential exposure. Because the subsequent requests are sent over a plaintext connection that was not properly secured via TLS through the proxy, any authentication headers included in these requests become visible to anyone with access to the network traffic at the proxy level or beyond. For applications using Basic Authentication, credentials consisting of usernames and passwords encoded in Base64 can be recovered directly by an attacker performing a man-in-the-middle attack. In scenarios involving NTLM authentication, while the responses are not immediately readable as plaintext passwords, they consist of cryptographic challenges and replies that can potentially be cracked offline or relayed to authenticate against other services if captured. This exposure compromises the confidentiality and integrity of user credentials and any data transmitted within those subsequent requests.
This flaw aligns with CWE-319, which classifies cleartext transmission of sensitive information over an insecure channel, as well as CWE-284 regarding improper access control where authentication checks are bypassed due to flawed logic. From a tactical perspective, this vulnerability facilitates credential theft and unauthorized access, mapping closely to techniques observed in the MITRE ATT&CK framework related to Credential Access via Network Sniffing or Protocol Tunneling abuse. The exploitation does not require complex payload injection but rather relies on the misconfiguration of proxy interactions and network interception capabilities available to adversaries positioned within the same network segment as the client application.
To mitigate this risk, organizations utilizing AsyncHttpClient must upgrade immediately to version 3.0.12 for the 3.x branch or version 2.16.1 for the 2.x branch, where the logic has been corrected to properly validate the CONNECT response before proceeding with origin requests. Developers should also review their proxy configurations and ensure that authentication mechanisms are robustly implemented at both the application and network layers. Implementing strict certificate pinning and monitoring for unexpected HTTP status codes during tunnel establishment can provide additional defense-in-depth measures against similar logic flaws in other libraries or custom implementations. Regular security audits of third-party dependencies are essential to prevent such vulnerabilities from impacting production environments.