All vulnerabilities
CVE-2026-107281GHSA-vvp4-63h8-v5pm

async-http-client: AsyncHttpClient: Connection pool key omits the authenticated principal, so an NTLM or Negotiate connection is reused across identities

AsyncHttpClient async-http-client
Open in ThreatlineRecord JSON
CVSS
7.6High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in3.0.13Also 2.16.1GitHub
Published7 Oct 2026Updated 8 Oct 2026CVE List

What fixes it

  • 3.0.13org.asynchttpclient:async-http-client, mavenGitHub<dependency><groupId>org.asynchttpclient</groupId><artifactId>async-http-client</artifactId><version>3.0.13</version></dependency>
  • 2.16.1org.asynchttpclient:async-http-client, mavenGitHub<dependency><groupId>org.asynchttpclient</groupId><artifactId>async-http-client</artifactId><version>2.16.1</version></dependency>

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, the HTTP/1.1 connection-pool key excludes the authenticated principal for connection-oriented NTLM and Negotiate authentication. A pooled socket authenticated for one request can be reused by a request carrying another principal, and the server executes that later request as the first identity. Basic and Digest are not affected because they authenticate each request. This issue is fixed in versions 3.0.13 and 2.16.1.

Text from CVE List

Affected versions 4

  • async-http-clientaffected: >= 3.0.0, < 3.0.13CVE List
  • async-http-clientaffected: >= 2.0.0, < 2.16.1CVE List
  • org.asynchttpclient:async-http-client, maven>= 3.0.0, <= 3.0.12GitHub
  • org.asynchttpclient:async-http-client, maven>= 2.0.0, <= 2.16.0GitHub

References 5