CVE-2026-107285 in async-http-client
Summary
by MITRE • 10/08/2026
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, a proxied ws request is carried through CONNECT, but NettyRequestFactory.newNettyRequest and requestUri decide whether to attach proxy authentication and an absolute-form target only from whether the URI is secure. Because ws is not marked secure, the tunneled WebSocket upgrade sent to the origin includes the proxy's Proxy-Authorization value. Basic credentials are directly recoverable and Digest responses can be replayed or cracked offline. This issue is fixed in versions 3.0.12 and 2.16.1.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/08/2026
The AsyncHttpClient library serves as a critical component for Java-based applications requiring efficient execution of HTTP requests and asynchronous processing of responses. A significant security flaw was identified within the proxy authentication handling logic, specifically affecting versions prior to 3.0.12 and 2.16.1. The vulnerability stems from an incorrect determination of whether a Uniform Resource Identifier is secure when establishing connections through proxies using the CONNECT method. This misclassification directly impacts WebSocket upgrades that are tunneled over HTTP/HTTPS proxy tunnels, leading to unintended exposure of sensitive authentication credentials.
The technical root cause lies in the NettyRequestFactory.newNettyRequest and requestUri methods within the library's codebase. These components decide whether to attach Proxy-Authorization headers based solely on whether the target URI is marked as secure, typically implying an HTTPS scheme. However, WebSocket connections initiated via a proxy often utilize the CONNECT method to establish a TCP tunnel before upgrading to the WebSocket protocol. In this context, the initial connection request may not be flagged as secure in the manner expected by the library's logic, even if the ultimate destination is intended to be protected. Consequently, the library erroneously attaches Proxy-Authorization headers containing credentials to these tunneled requests.
This architectural oversight results in a severe information disclosure vulnerability. When Basic authentication is employed, the proxy sends Base64-encoded username and password pairs directly within the HTTP header of the CONNECT request or subsequent tunnel traffic if not properly isolated. Since basic credentials are transmitted without additional cryptographic protection beyond encoding, they can be trivially recovered by any observer with access to network traffic, including malicious proxies or man-in-the-middle attackers on untrusted networks. Furthermore, even when Digest authentication is used, which typically involves a challenge-response mechanism, the replayed digest values captured from these improperly authenticated connections can potentially be cracked offline using brute-force techniques if weak passwords are selected, thereby compromising user identity and access controls.
The operational impact of this vulnerability extends beyond simple credential theft. It undermines the integrity of proxy-based security architectures where proxies act as gatekeepers or load balancers. Attackers who intercept these requests gain unauthorized access to internal services protected by proxy authentication layers. This can lead to further exploitation, including data exfiltration, session hijacking if sessions are established post-proxy, and lateral movement within network segments that rely on the compromised credentials for trust relationships. The vulnerability effectively bypasses a layer of defense intended to restrict access based on valid proxy authorization.
To mitigate this risk, organizations utilizing AsyncHttpClient must upgrade immediately to version 3.0.12 or later, or version 2.16.1 and above, where the logic has been corrected to properly handle authentication for WebSocket upgrades over proxies. For environments unable to patch immediately, implementing network-level monitoring can help detect anomalous traffic patterns involving CONNECT requests with embedded credentials. Additionally, enforcing strict proxy policies that reject unauthorized connection attempts and ensuring that internal services do not rely solely on proxy-layer authentication for critical security boundaries are recommended defensive measures. This issue is categorized under CWE-319: Cleartext Transmission of Sensitive Information and aligns with ATT&CK techniques related to Credential Access and Network Sniffing, highlighting the importance of securing all communication channels regardless of protocol type or tunneling method.