Local File Manipulation in AsyncHttpClient Library Affecting Java Applications
CVE-2026-102740

5.8MEDIUM

Key Information:

Vendor

Asynchttpclient

Status
Async-http-client
Vendor
CVE Published:
15 October 2026

What is CVE-2026-102740?

The AsyncHttpClient library has a vulnerability in how it manages resumable download states. Stored in a predictable path with weak permissions, the stored data can be accessed by local users, revealing sensitive URLs and embedded user information. Furthermore, a local user who can write to this directory could create a symbolic link, leading to potential overwriting of other files. This security flaw is resolved in versions 2.16.1 and 3.0.12, where the handling of resumable states has been fortified.

Affected Version(s)

async-http-client >= 2.0.0, < 2.16.1 < 2.0.0, 2.16.1

async-http-client >= 3.0.0, < 3.0.12 < 3.0.0, 3.0.12

References

https://github.com/AsyncHttpClient/async-http-client/secu...
x_refsource_CONFIRM
https://github.com/AsyncHttpClient/async-http-client/pull...
x_refsource_MISC
https://github.com/AsyncHttpClient/async-http-client/comm...
x_refsource_MISC

CVSS V3.1

Score:
5.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.