WebSocket Proxy Authentication Vulnerability in AsyncHttpClient Library
CVE-2026-107285
5.9MEDIUM
What is CVE-2026-107285?
The AsyncHttpClient library has a vulnerability that allows for the exposure of proxy authentication credentials during proxied WebSocket requests. When executing a WebSocket handshake via HTTP CONNECT, the library improperly handles whether to attach proxy authentication based solely on the URI's security. This results in the Proxy-Authorization header being sent along with unsecured WebSocket requests, allowing attackers to recover basic credentials and potentially replay or crack Digest responses offline. The issue has been addressed in versions 3.0.12 and 2.16.1, which mitigate these risks.
Affected Version(s)
async-http-client >= 3.0.0, <3.0.12 < 3.0.0, 3.0.12
async-http-client >= 2.0.0, < 2.16.1 < 2.0.0, 2.16.1