VDB

CVE-2026-107282

CVE-2026-107282 PUBLISHED CVSS 9.4 CRITICAL

Reported by GitHub_M · Published October 7, 2026

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, cross-host request replay updates the current request but leaves the target request and related proxy context pointing at the original origin. Connection-pool selection, CONNECT handling, realm selection, and TLS setup can consequently send the original host's path, Host header, Authorization credentials, or plaintext request to the replay destination. Documented ResponseFilter failover and retry paths can trigger the replay. This issue is fixed in versions 3.0.13 and 2.16.1.

Risk Scores

CVSS 4.0
9.4
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Affected Products

VendorProductVersions
AsyncHttpClientasync-http-client>= 3.0.0, < 3.0.13, >= 2.0.0, < 2.16.1
AsyncHttpClientasync-http-client2.0.0, 3.0.0
wolfidruid0
chainguarddruid0
chainguardpinot-fips0
Mavenorg.asynchttpclient:async-http-client2.0.0, 3.0.0
chainguardpinot0

Timeline

  • Oct 7, 2026 CVE Published
  • Oct 8, 2026 EPSS Score
  • Oct 8, 2026 Coalition ESS Score
  • Oct 10, 2026 CVE Updated
  • Oct 13, 2026 EPSS Score
  • Oct 19, 2026 EPSS Score
  • Oct 25, 2026 EPSS Score
  • Oct 30, 2026 EPSS Score
  • Oct 30, 2026 Security Advisory

References

Open in Interactive Console →
$ Console Community · 50/day Open console ›