Authentication Vulnerability in AsyncHttpClient Library Affecting Java Applications
CVE-2026-107231
What is CVE-2026-107231?
The AsyncHttpClient library, utilized for managing HTTP requests in Java applications, has a concerning vulnerability affecting how it handles authorization challenges. Prior to versions 3.0.13 and 2.16.1, when facing a Digest challenge without a usable nonce, the library mistakenly processes it as a Basic challenge. This flaw could enable a malicious actor to exploit this misconfiguration, compelling the client to send user credentials in a reversible Basic authentication format. As both the client and proxy challenge parsers are susceptible, this poses significant security risks, necessitating an urgent update to the latest versions to mitigate exposure.
Affected Version(s)
async-http-client >= 3.0.0.Beta1, < 3.0.13 < 3.0.0.Beta1, 3.0.13
async-http-client >= 2.0.0, < 2.16.1 < 2.0.0, 2.16.1