Skip to content
Fencer Vulns
critical 9.4

CVE-2026-107282 json

AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host

published 2026-10-07 32 d ago modified 2026-10-10 30 d ago also GHSA-jmqq-x5g9-9p2w , EUVD-2026-94642

cvss
9.4
version 4.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 8%
public exploits
0
none known

Summary

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, cross-host request replay updates the current request but leaves the target request and related proxy context pointing at the original origin. Connection-pool selection, CONNECT handling, realm selection, and TLS setup can consequently send the original host's path, Host header, Authorization credentials, or plaintext request to the replay destination. Documented ResponseFilter failover and retry paths can trigger the replay. This issue is fixed in versions 3.0.13 and 2.16.1.

Patch / fix

  • maven org.asynchttpclient:async-http-client 2.16.1, 3.0.13

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-107282 updated cvss 6.5

org.asynchttpclient/async-http-client: AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host

  • Red Hat Fuse 7 async-http-client, async-http-client-netty-utils
    not affected: vulnerable code not in execute path

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
30 d ago

Exploit prediction

0.19% chance of exploitation in the next 30 days, higher than 8% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 9.4 CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
CNA 4.0 9.4 CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected packages

ecosystem package affected fixed in
maven org.asynchttpclient:async-http-client
>=3.0.0, <3.0.13
>=2.0.0, <2.16.1
3.0.13
2.16.1

Affected products

  • AsyncHttpClient async-http-client

Classification

Weakness
  • CWE-319 Cleartext Transmission of Sensitive Information
  • CWE-441 Unintended Proxy or Intermediary
  • CWE-522 Insufficiently Protected Credentials

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.