Authentication Exposure in AsyncHttpClient Library by AsyncHttpClient
CVE-2026-85719
What is CVE-2026-85719?
The AsyncHttpClient library allows Java applications to perform HTTP operations asynchronously. A significant vulnerability exists in versions 2.1.0 through 2.16.1 and 3.0.12, where requests routed through an authenticated SOCKS proxy can unintentionally expose the proxy's credentials. This occurs because the library attaches the Proxy-Authorization header without confirming the request is directed towards an HTTP proxy, leading to plaintext transmission of sensitive credentials. The default behavior of preemptive proxy authentication opens a route for adversaries to intercept and exploit credentials, including NTLM, Kerberos, and SPNEGO, through a compromised SOCKS tunnel. The issue has been addressed in versions 2.16.1 and 3.0.12, ensuring enhanced protection for users.
Affected Version(s)
async-http-client >= 2.1.0, < 2.16.1 < 2.1.0, 2.16.1
async-http-client >= 3.0.0, < 3.0.12 < 3.0.0, 3.0.12