AsyncHttpClient async-http-client prior 2.16.1/3.0.12 WebSocket Upgrade NettyRequestFactory.newNettyRequest information disclosure

Summaryinfo

A vulnerability was found in AsyncHttpClient async-http-client and classified as problematic. This issue affects the function NettyRequestFactory.newNettyRequest of the component WebSocket Upgrade. The manipulation results in information disclosure. This vulnerability was named CVE-2026-107285. The attack may be performed from remote. There is no available exploit. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic has been found in AsyncHttpClient async-http-client. Affected is the function NettyRequestFactory.newNettyRequest of the component WebSocket Upgrade. The manipulation with an unknown input leads to a information disclosure vulnerability. CWE is classifying the issue as CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. This is going to have an impact on confidentiality. CVE summarizes:

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, a proxied ws request is carried through CONNECT, but NettyRequestFactory.newNettyRequest and requestUri decide whether to attach proxy authentication and an absolute-form target only from whether the URI is secure. Because ws is not marked secure, the tunneled WebSocket upgrade sent to the origin includes the proxy's Proxy-Authorization value. Basic credentials are directly recoverable and Digest responses can be replayed or cracked offline. This issue is fixed in versions 3.0.12 and 2.16.1.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-107285 since 10/07/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1592.

Upgrading to version 2.16.1 or 3.0.12 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• AsyncHttpClient

Name

• async-http-client

Website

• Product: https://github.com/AsyncHttpClient/async-http-client/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion