CVE-2026-85717 in Async-Http-Client
Summary
by MITRE • 09/17/2026
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.14.5 to 2.16.0 and from 3.0.9 to 3.0.11, a client configured with a client-wide Realm and redirect following can disclose credentials after a cross-origin redirect because the Interceptors authentication path falls back to the client configuration after redirect handling clears the per-exchange realm. If the attacker-controlled target returns 401, the client can send Basic or Digest credentials or a Negotiate or NTLM token to that origin. Per-request realms are stripped correctly, and this issue is a residual bypass of the earlier cross-origin credential-stripping fixes. This issue is fixed in versions 2.16.1 and 3.0.12.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The AsyncHttpClient library serves as a critical component for Java-based applications requiring efficient execution of HTTP requests and asynchronous processing of responses. While the library provides robust mechanisms for handling authentication through client-wide realms, it contains a significant security flaw affecting versions from 2.14.5 to 2.16.0 and from 3.0.9 to 3.0.11. This vulnerability arises specifically when a client is configured with a global realm and has redirect following enabled. The core technical failure lies in the interaction between the interceptor authentication path and the redirect handling logic. When an HTTP request triggers a cross-origin redirect, the library correctly clears any per-exchange realm to prevent credential leakage for that specific exchange context. However, due to a residual bypass of earlier fixes designed to strip credentials across origins, the authentication mechanism subsequently falls back to the client-wide configuration. This fallback behavior effectively reinstates the global authentication settings even after the origin has changed, creating a pathway for unauthorized data exposure.
The operational impact of this vulnerability is severe, as it allows an attacker-controlled target server to capture sensitive user credentials during the redirect process. If the initial request or any subsequent redirected request results in a 401 Unauthorized response from the malicious destination, the AsyncHttpClient will automatically attach and transmit Basic authentication headers containing username and password pairs, Digest authentication tokens, Negotiate Kerberos tickets, or NTLM security contexts to that untrusted origin. This behavior directly contradicts standard web security practices which dictate that credentials should never be sent to a different domain than the one originally intended by the application developer. The vulnerability represents a regression in security posture, as it bypasses previous mitigations that were implemented to address similar cross-origin credential stripping issues, indicating an incomplete fix in earlier versions of the library.
From a classification perspective, this flaw aligns with CWE-201: Information Exposure Through Sent Data and CWE-524: Use of Cache Containing Sensitive Information if one considers the state management aspect, but most accurately maps to CWE-384: Session Fixation or more specifically CWE-918 in the context of server-side request forgery implications where credentials are leaked. In terms of the MITRE ATT&CK framework, this vulnerability facilitates Credential Access via Tactic 1072 and can be leveraged for Initial Access if those stolen credentials provide entry into other systems. The attack vector typically involves an attacker controlling a web service that issues redirects to their domain or manipulating DNS to point legitimate requests to malicious infrastructure, thereby intercepting the authentication headers before they are discarded or misrouted.
To mitigate this risk, organizations utilizing AsyncHttpClient must immediately upgrade to version 2.16.1 or later for the legacy branch and version 3.0.12 or later for the current release line. These updated versions correct the logic within the interceptor chain to ensure that client-wide realms are not reapplied after a cross-origin redirect has occurred, thereby maintaining strict origin-bound authentication policies. For applications unable to upgrade immediately due to dependency constraints, developers should implement custom interceptors or filters that explicitly validate the target host of every request against an allowlist before allowing any authentication headers to be attached. Additionally, auditing code for usage patterns involving global realms combined with automatic redirect following is essential to identify other potential instances where this logic might expose sensitive data. Regular security assessments and dependency scanning should be employed to detect such library vulnerabilities early in the development lifecycle.