CVE-2026-107279 in AsyncHttpClient
Summary
by MITRE • 10/08/2026
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. In 3.0.12, a peer offering only Digest qop=auth-int causes mutual-authentication verification to be skipped. AuthenticatorUtils.computeExpectedRspAuth returns no expected value for auth-int, and Interceptors treats that result as unverifiable but nonfatal, so a response with an invalid rspauth value is accepted. A peer that does not know the shared secret can therefore be accepted as the authenticated server. This issue is fixed in version 3.0.13.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/08/2026
The AsyncHttpClient library serves as a critical component for Java-based applications requiring efficient execution of HTTP requests and asynchronous processing of responses. In version 3.0.12, a significant security flaw exists within the implementation of mutual authentication mechanisms when interacting with servers that utilize Digest access control specifically configured with qop=auth-int quality protection. This vulnerability stems from an incomplete validation logic in the AuthenticatorUtils.computeExpectedRspAuth method, which fails to generate or return an expected response value for auth-int scenarios. Consequently, the subsequent verification step handled by Interceptors interprets this absence of an expected value not as a fatal authentication failure but rather as an unverifiable state that is non-fatal and thus acceptable.
This logical error effectively bypasses mutual-authentication verification requirements. In a standard Digest authentication flow with qop=auth-int, both the client and server are required to prove their identity using shared secrets through cryptographic hashing of request and response data including integrity checks on message bodies. However, because the library does not compute or validate the expected rspauth value for auth-int, it accepts responses from peers that do not possess the correct shared secret. This allows an unauthenticated attacker or a malicious server to impersonate a legitimate authenticated peer without triggering any security alerts or connection termination events within the client application.
The operational impact of this vulnerability is severe in environments where mutual authentication is mandated for securing sensitive data exchanges or ensuring trusted communication channels between services. An adversary exploiting this flaw could perform man-in-the-middle attacks, inject malicious payloads into responses, or exfiltrate confidential information by posing as a legitimate server endpoint. Since the library treats the missing validation as non-fatal, applications relying on AsyncHttpClient 3.0.12 may inadvertently establish trusted sessions with unauthorized entities, compromising data integrity and confidentiality across distributed systems that depend on this client for service-to-service communication.
To mitigate this risk, organizations must upgrade to version 3.0.13 or later of the AsyncHttpClient library where the mutual-authentication verification logic has been corrected to properly handle auth-int scenarios. This update ensures that rspauth values are correctly computed and validated against expected cryptographic hashes derived from shared secrets. Additionally, security teams should review their dependency management strategies to ensure no legacy versions remain in production environments. Implementing strict certificate pinning or additional application-layer authentication checks can provide defense-in-depth measures while the library upgrade is being deployed across infrastructure components that utilize this HTTP client for critical communications.
This vulnerability aligns with CWE-287 Improper Authentication as it involves a failure to correctly verify the identity of an entity during mutual authentication processes. Furthermore, from an ATT&CK perspective, exploitation relates to T1078 Valid Accounts and potentially T1499 Endpoint Denial of Service if used in conjunction with other attacks to disrupt trusted service interactions by injecting unauthorized responses into legitimate traffic flows. Addressing this issue is essential for maintaining the integrity of zero-trust architectures that rely on robust mutual TLS or Digest-based authentication mechanisms within Java ecosystems.