All vulnerabilities
CVE-2026-107285GHSA-3wp9-xfwm-rjjf

org.asynchttpclient:async-http-client: AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel

AsyncHttpClient org.asynchttpclient:async-http-clientmavenLibraries & packages
Open in ThreatlineRecord JSON
CVSS
5.9Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.21%Chance of exploitation activity in the next 30 days, higher than 10% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in3.0.12Also 2.16.1GitHub
Published7 Oct 2026Updated 8 Oct 2026CVE List

What fixes it

  • 3.0.12org.asynchttpclient:async-http-client, mavenGitHub<dependency><groupId>org.asynchttpclient</groupId><artifactId>async-http-client</artifactId><version>3.0.12</version></dependency>
  • 2.16.1org.asynchttpclient:async-http-client, mavenGitHub<dependency><groupId>org.asynchttpclient</groupId><artifactId>async-http-client</artifactId><version>2.16.1</version></dependency>
  • 3.0.12org.asynchttpclient:async-http-client, MavenOSV<dependency><groupId>org.asynchttpclient</groupId><artifactId>async-http-client</artifactId><version>3.0.12</version></dependency>
  • 2.16.1org.asynchttpclient:async-http-client, MavenOSV<dependency><groupId>org.asynchttpclient</groupId><artifactId>async-http-client</artifactId><version>2.16.1</version></dependency>

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

When a ws:// request is routed through an HTTP proxy with proxy authentication configured, the client tunnels the connection with an HTTP CONNECT, the same as it does for https://. Once the tunnel is open, the WebSocket upgrade request that follows is sent through the tunnel directly to the origin server, not to the proxy. The proxy-auth gate and the companion request-target selection keyed only on whether the URI was secured, which is false for ws://, so the tunnelled upgrade request incorrectly carried the proxy's Proxy-Authorization header and an absolute-form request target meant for the proxy. Any origin server reached over a proxied ws:// connection, or anyone positioned on the origin side of the wire, could recover the proxy credentials: directly for Basic, or as a replayable and offline-crackable response for Digest.

Affected versions

  • 3.x: up to and including 3.0.11
  • 2.x: up to and including 2.16.0

Patches

Fixed in 3.0.12 on the 3.x line and in 2.16.1 on the 2.x line. The preemptive Proxy-Authorization header and the absolute-form request target are no longer attached to a tunnelled ws:// upgrade; a ws:// request is now treated like wss://.

Workarounds

Do not use proxy authentication together with ws:// requests through an HTTP proxy, or use wss:// instead.

Details

The proxy-auth gate in NettyRequestFactory#newNettyRequest and the sibling branch in requestUri() did not exclude WebSocket URIs, even though the CONNECT-tunnelling check in NettyRequestSender already tunnels ws:// through CONNECT exactly like https://.

Note that 3.0.12 is itself affected by a separate issue, GHSA-rqf5-2wxv-rjf4, where a Digest challenge the client cannot read downgrades to Basic and sends the password in cleartext. Upgrade to 3.0.13 to pick up both fixes.

Text from GitHub Advisory Database

Affected versions 68

  • org.asynchttpclient:async-http-client, maven>= 3.0.0, <= 3.0.11GitHub
  • org.asynchttpclient:async-http-client, maven>= 2.0.0, <= 2.16.0GitHub
  • async-http-clientaffected: >= 3.0.0, <3.0.12CVE List
  • async-http-clientaffected: >= 2.0.0, < 2.16.1CVE List
  • org.asynchttpclient:async-http-client, Mavenfrom 3.0.0, fixed in 3.0.12OSV
  • org.asynchttpclient:async-http-client, Maven3.0.0OSV
  • org.asynchttpclient:async-http-client, Maven3.0.1OSV
  • org.asynchttpclient:async-http-client, Maven3.0.10OSV
  • org.asynchttpclient:async-http-client, Maven3.0.11OSV
  • org.asynchttpclient:async-http-client, Maven3.0.2OSV
  • org.asynchttpclient:async-http-client, Maven3.0.3OSV
  • org.asynchttpclient:async-http-client, Maven3.0.4OSV
  • org.asynchttpclient:async-http-client, Maven3.0.5OSV
  • org.asynchttpclient:async-http-client, Maven3.0.6OSV
  • org.asynchttpclient:async-http-client, Maven3.0.7OSV
  • org.asynchttpclient:async-http-client, Maven3.0.8OSV
  • org.asynchttpclient:async-http-client, Maven3.0.9OSV
  • org.asynchttpclient:async-http-client, Mavenfrom 2.0.0, fixed in 2.16.1OSV
  • org.asynchttpclient:async-http-client, Maven2.0.0OSV
  • org.asynchttpclient:async-http-client, Maven2.0.1OSV
  • org.asynchttpclient:async-http-client, Maven2.0.10OSV
  • org.asynchttpclient:async-http-client, Maven2.0.11OSV
  • org.asynchttpclient:async-http-client, Maven2.0.12OSV
  • org.asynchttpclient:async-http-client, Maven2.0.13OSV
  • org.asynchttpclient:async-http-client, Maven2.0.14OSV
  • org.asynchttpclient:async-http-client, Maven2.0.15OSV
  • org.asynchttpclient:async-http-client, Maven2.0.16OSV
  • org.asynchttpclient:async-http-client, Maven2.0.17OSV
  • org.asynchttpclient:async-http-client, Maven2.0.18OSV
  • org.asynchttpclient:async-http-client, Maven2.0.19OSV
  • org.asynchttpclient:async-http-client, Maven2.0.2OSV
  • org.asynchttpclient:async-http-client, Maven2.0.20OSV
  • org.asynchttpclient:async-http-client, Maven2.0.21OSV
  • org.asynchttpclient:async-http-client, Maven2.0.22OSV
  • org.asynchttpclient:async-http-client, Maven2.0.23OSV
  • org.asynchttpclient:async-http-client, Maven2.0.24OSV
  • org.asynchttpclient:async-http-client, Maven2.0.25OSV
  • org.asynchttpclient:async-http-client, Maven2.0.26OSV
  • org.asynchttpclient:async-http-client, Maven2.0.27OSV
  • org.asynchttpclient:async-http-client, Maven2.0.28OSV
  • org.asynchttpclient:async-http-client, Maven2.0.29OSV
  • org.asynchttpclient:async-http-client, Maven2.0.3OSV
  • org.asynchttpclient:async-http-client, Maven2.0.30OSV
  • org.asynchttpclient:async-http-client, Maven2.0.31OSV
  • org.asynchttpclient:async-http-client, Maven2.0.32OSV
  • org.asynchttpclient:async-http-client, Maven2.0.33OSV
  • org.asynchttpclient:async-http-client, Maven2.0.34OSV
  • org.asynchttpclient:async-http-client, Maven2.0.35OSV
  • org.asynchttpclient:async-http-client, Maven2.0.36OSV
  • org.asynchttpclient:async-http-client, Maven2.0.37OSV
  • org.asynchttpclient:async-http-client, Maven2.0.38OSV
  • org.asynchttpclient:async-http-client, Maven2.0.39OSV
  • org.asynchttpclient:async-http-client, Maven2.0.4OSV
  • org.asynchttpclient:async-http-client, Maven2.0.40OSV
  • org.asynchttpclient:async-http-client, Maven2.0.5OSV
  • org.asynchttpclient:async-http-client, Maven2.0.6OSV
  • org.asynchttpclient:async-http-client, Maven2.0.7OSV
  • org.asynchttpclient:async-http-client, Maven2.0.8OSV
  • org.asynchttpclient:async-http-client, Maven2.0.9OSV
  • org.asynchttpclient:async-http-client, Maven2.1.0OSV
  • org.asynchttpclient:async-http-client, Maven2.1.0-RC1OSV
  • org.asynchttpclient:async-http-client, Maven2.1.0-RC2OSV
  • org.asynchttpclient:async-http-client, Maven2.1.0-RC3OSV
  • org.asynchttpclient:async-http-client, Maven2.1.0-RC4OSV
  • org.asynchttpclient:async-http-client, Maven2.1.0-alpha1OSV
  • org.asynchttpclient:async-http-client, Maven2.1.0-alpha10OSV
  • org.asynchttpclient:async-http-client, Maven2.1.0-alpha11OSV
  • org.asynchttpclient:async-http-client, Maven2.1.0-alpha12OSV

References 7