CVE-2026-107231

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-107231
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107231.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-107231
Aliases
Downstream
CGA (6)
CLSA (1)
DEBIAN (1)
ECHO (1)
MINI (4)
ROOT (1)
UBUNTU (1)
Published
2026-10-07T21:06:26Z
Modified
2026-10-28T11:04:05Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext
Details

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, Realm.Builder treats a Digest challenge that yields no usable nonce as a Basic challenge. A malicious origin or proxy can label a challenge Digest while omitting or emptying the nonce, causing the client to resend the username and password using reversible Basic authentication. Both origin and proxy challenge parsers are affected. This issue is fixed in versions 3.0.13 and 2.16.1.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-319",
        "CWE-522",
        "CWE-757"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107231.json"
}
References

Affected packages

Git / github.com/asynchttpclient/async-http-client

Affected ranges

Type
GIT
Repo
https://github.com/asynchttpclient/async-http-client
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
35ad15f2f6b1788e3761b0c940a9d7ae3fe64c5d
Introduced
b60e5a0d7d989e4a24c13e03ba786c375b727448
Fixed
d1f0ccec417092098d40242fee7dfac84bb3c21f
Fixed
8376866aa9b5a7653ad19db9d472692f875caa83
Fixed
c8d639bf6ac341d377d610a93570bcd15565f1a6
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "3.0.0.Beta1"
                },
                {
                    "fixed":  "3.0.13"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "introduced":  "2.0.0"
                },
                {
                    "fixed":  "2.16.1"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "fixed":  "8376866aa9b5a7653ad19db9d472692f875caa83"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "range":  [
                {
                    "fixed":  "c8d639bf6ac341d377d610a93570bcd15565f1a6"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "async-http-client-project-2.16.1",
            "range":  [
                {
                    "fixed":  "d1f0ccec417092098d40242fee7dfac84bb3c21f"
                }
            ],
            "source":  "REFERENCES_TAG"
        },
        {
            "original_tag":  "async-http-client-project-3.0.13",
            "range":  [
                {
                    "fixed":  "35ad15f2f6b1788e3761b0c940a9d7ae3fe64c5d"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

async-http-client-project-2.*
async-http-client-project-2.0.0
async-http-client-project-2.0.1
async-http-client-project-2.0.10
async-http-client-project-2.0.11
async-http-client-project-2.0.12
async-http-client-project-2.0.13
async-http-client-project-2.0.14
async-http-client-project-2.0.15
async-http-client-project-2.0.16
async-http-client-project-2.0.17
async-http-client-project-2.0.18
async-http-client-project-2.0.19
async-http-client-project-2.0.2
async-http-client-project-2.0.20
async-http-client-project-2.0.21
async-http-client-project-2.0.22
async-http-client-project-2.0.23
async-http-client-project-2.0.24
async-http-client-project-2.0.3
async-http-client-project-2.0.4
async-http-client-project-2.0.5
async-http-client-project-2.0.6
async-http-client-project-2.0.7
async-http-client-project-2.0.8
async-http-client-project-2.0.9
async-http-client-project-2.1.0
async-http-client-project-2.1.0-RC1
async-http-client-project-2.1.0-RC2
async-http-client-project-2.1.0-RC3
async-http-client-project-2.1.0-RC4
async-http-client-project-2.1.0-alpha10
async-http-client-project-2.1.0-alpha11
async-http-client-project-2.1.0-alpha12
async-http-client-project-2.1.0-alpha13
async-http-client-project-2.1.0-alpha14
async-http-client-project-2.1.0-alpha15
async-http-client-project-2.1.0-alpha16
async-http-client-project-2.1.0-alpha17
async-http-client-project-2.1.0-alpha18
async-http-client-project-2.1.0-alpha19
async-http-client-project-2.1.0-alpha2
async-http-client-project-2.1.0-alpha20
async-http-client-project-2.1.0-alpha21
async-http-client-project-2.1.0-alpha22
async-http-client-project-2.1.0-alpha23
async-http-client-project-2.1.0-alpha24
async-http-client-project-2.1.0-alpha25
async-http-client-project-2.1.0-alpha26
async-http-client-project-2.1.0-alpha3
async-http-client-project-2.1.0-alpha4
async-http-client-project-2.1.0-alpha5
async-http-client-project-2.1.0-alpha6
async-http-client-project-2.1.0-alpha7
async-http-client-project-2.1.0-alpha8
async-http-client-project-2.1.0-alpha9
async-http-client-project-2.1.1
async-http-client-project-2.1.2
async-http-client-project-2.10.0
async-http-client-project-2.10.1
async-http-client-project-2.10.2
async-http-client-project-2.10.3
async-http-client-project-2.10.4
async-http-client-project-2.10.5
async-http-client-project-2.11.0
async-http-client-project-2.12.0
async-http-client-project-2.12.1
async-http-client-project-2.12.2
async-http-client-project-2.12.3
async-http-client-project-2.12.4
async-http-client-project-2.14.5
async-http-client-project-2.15.0
async-http-client-project-2.16.0
async-http-client-project-2.2.0
async-http-client-project-2.2.1
async-http-client-project-2.3.0
async-http-client-project-2.4.0
async-http-client-project-2.4.1
async-http-client-project-2.4.2
async-http-client-project-2.4.3
async-http-client-project-2.4.4
async-http-client-project-2.4.5
async-http-client-project-2.4.6
async-http-client-project-2.4.7
async-http-client-project-2.4.8
async-http-client-project-2.4.9
async-http-client-project-2.5.0
async-http-client-project-2.5.1
async-http-client-project-2.5.2
async-http-client-project-2.5.3
async-http-client-project-2.5.4
async-http-client-project-2.6.0
async-http-client-project-2.7.0
async-http-client-project-2.8.0
async-http-client-project-2.8.1
async-http-client-project-2.9.0
async-http-client-project-3.*
async-http-client-project-3.0.0
async-http-client-project-3.0.0.Beta2
async-http-client-project-3.0.0.Beta3
async-http-client-project-3.0.1
async-http-client-project-3.0.10
async-http-client-project-3.0.11
async-http-client-project-3.0.12
async-http-client-project-3.0.2
async-http-client-project-3.0.3
async-http-client-project-3.0.4
async-http-client-project-3.0.5
async-http-client-project-3.0.6
async-http-client-project-3.0.7
async-http-client-project-3.0.8
async-http-client-project-3.0.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107231.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "81899338064176927563121070890897858680",
                "192104886256718646688823141888745554964",
                "136610557841836448972693982538800298787",
                "44055749827903875956139429972684553961",
                "25443729301488350147006781700859772219",
                "293329865423044074336755593113509474565",
                "125739660855641145681176314136878947743",
                "38846744088845150908098008828879833676",
                "25443729301488350147006781700859772219",
                "293329865423044074336755593113509474565",
                "125739660855641145681176314136878947743",
                "38846744088845150908098008828879833676"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-107231-08ddb171",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/asynchttpclient/async-http-client/commit/c8d639bf6ac341d377d610a93570bcd15565f1a6",
        "target":  {
            "file":  "client/src/main/java/org/asynchttpclient/Realm.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "150620244463329851497396714369833254358",
            "length":  405
        },
        "id":  "CVE-2026-107231-1fcb8a07",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/asynchttpclient/async-http-client/commit/c8d639bf6ac341d377d610a93570bcd15565f1a6",
        "target":  {
            "file":  "client/src/test/java/org/asynchttpclient/util/PerConnectionAuthorizationHeaderTest.java",
            "function":  "negotiateTokenTargetsTheOriginEvenBehindAProxy"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "219246596221720898981563676126452787927",
                "112413554918931264338179563940130289539",
                "262908889413526511266896616639455764237"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-107231-26220b3f",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/asynchttpclient/async-http-client/commit/d1f0ccec417092098d40242fee7dfac84bb3c21f",
        "target":  {
            "file":  "client/src/main/java/org/asynchttpclient/cookie/ThreadSafeCookieStore.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "178629091691316278700380575556418365098",
                "189453453697103742336932953302658599644",
                "44889353348026218163693637070669775517",
                "39170752322046420634219453919673855610",
                "178629091691316278700380575556418365098",
                "189453453697103742336932953302658599644",
                "306151023689890714946006533934881611772",
                "202052700755830293312637757886034718924",
                "171709525251192094944437254318432123039",
                "13351072174495393091389274258066808928",
                "265036225435353584694292685108358700555",
                "106370383276790194572699951202036259576",
                "23084570464242823553795788117845816925",
                "174572265749544345280323828389710611952",
                "302619369071971747253023327927887893409",
                "320035090805814246089786544590980457263",
                "248588992508915909861150706192123061213",
                "145035731972319106137979090188354481624",
                "157466257495341956599714073495272080161",
                "130280792048186995797576342363781087589",
                "143579168330305562593931841724210885992",
                "325089825942754735065868855897224896507",
                "296464822687671034507434458030406001475"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-107231-2bcfc522",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/asynchttpclient/async-http-client/commit/8376866aa9b5a7653ad19db9d472692f875caa83",
        "target":  {
            "file":  "client/src/main/java/org/asynchttpclient/Realm.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "241227568769616852635528981392573923633",
                "149973215508730848901494720610873769705",
                "115141405942693491001649820164416439214"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-107231-3ede1e3f",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/asynchttpclient/async-http-client/commit/8376866aa9b5a7653ad19db9d472692f875caa83",
        "target":  {
            "file":  "client/src/test/java/org/asynchttpclient/RealmTest.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "57150096354167983771768809939478785291",
                "23822957414500289529832286170761361638",
                "272369923036053634001648275993842791841",
                "46339610403769380081975049702553798641",
                "20208082286529891221833911604358496855",
                "10908678376198386682411195467574253199",
                "238873265398338754762741292250812131536",
                "317185873645083097520154884430676625086",
                "140731784517807421755899579051271485029",
                "11796539681654638798101036326915123554",
                "156483860764741876403073413402551242967",
                "170211332957910069501329373152448644329",
                "151766991681609626867417975029770964050",
                "4915009931684987441080807124242247427"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-107231-67276c52",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/asynchttpclient/async-http-client/commit/c8d639bf6ac341d377d610a93570bcd15565f1a6",
        "target":  {
            "file":  "client/src/test/java/org/asynchttpclient/util/PerConnectionAuthorizationHeaderTest.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "303060184721305506653650585179027871955",
            "length":  740
        },
        "id":  "CVE-2026-107231-8248c14e",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/asynchttpclient/async-http-client/commit/8376866aa9b5a7653ad19db9d472692f875caa83",
        "target":  {
            "file":  "client/src/main/java/org/asynchttpclient/Realm.java",
            "function":  "parseWWWAuthenticateHeader"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "2430482482852298504890500874336542793",
            "length":  394
        },
        "id":  "CVE-2026-107231-a497e232",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/asynchttpclient/async-http-client/commit/c8d639bf6ac341d377d610a93570bcd15565f1a6",
        "target":  {
            "file":  "client/src/main/java/org/asynchttpclient/Realm.java",
            "function":  "parseProxyAuthenticateHeader"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "115021014688937232358693913355291667023",
            "length":  409
        },
        "id":  "CVE-2026-107231-b4f54b63",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/asynchttpclient/async-http-client/commit/8376866aa9b5a7653ad19db9d472692f875caa83",
        "target":  {
            "file":  "client/src/main/java/org/asynchttpclient/Realm.java",
            "function":  "unquote"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "261210611830463910587905448181325491159",
                "281601276310722404824685684857603078799",
                "88112857462797964758568087274193412347",
                "295569977276399205413069829224090359072",
                "18783924725518004908157624930549732498",
                "289450135854647069055412612831317490398",
                "290111173150853179179664165541801137627",
                "243249129783590225241181622646028057879",
                "288503312493900088638632685768487475978",
                "198167493333990458060718733653734253968",
                "270827170758363002191006885206862168479"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-107231-be8b5305",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/asynchttpclient/async-http-client/commit/c8d639bf6ac341d377d610a93570bcd15565f1a6",
        "target":  {
            "file":  "client/src/test/java/org/asynchttpclient/spnego/SpnegoEngineTest.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "101039636566247414344318033830686166258",
            "length":  266
        },
        "id":  "CVE-2026-107231-c7b19e47",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/asynchttpclient/async-http-client/commit/8376866aa9b5a7653ad19db9d472692f875caa83",
        "target":  {
            "file":  "client/src/main/java/org/asynchttpclient/Realm.java",
            "function":  "endOfQuotedString"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "319981061666573934872902157208912328509",
            "length":  685
        },
        "id":  "CVE-2026-107231-c7b286ac",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/asynchttpclient/async-http-client/commit/d1f0ccec417092098d40242fee7dfac84bb3c21f",
        "target":  {
            "file":  "client/src/main/java/org/asynchttpclient/cookie/ThreadSafeCookieStore.java",
            "function":  "add"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "280595304001836323566639239228489462610",
                "245534731230120988934486495067574119827",
                "209421806733781920957291838462384522382",
                "162250420293888272969687881305686905909"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-107231-cf9f1d65",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/asynchttpclient/async-http-client/commit/c8d639bf6ac341d377d610a93570bcd15565f1a6",
        "target":  {
            "file":  "client/src/test/java/org/asynchttpclient/RealmTest.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "180275678400293729063802004384873360521",
            "length":  448
        },
        "id":  "CVE-2026-107231-d2b8a051",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/asynchttpclient/async-http-client/commit/c8d639bf6ac341d377d610a93570bcd15565f1a6",
        "target":  {
            "file":  "client/src/main/java/org/asynchttpclient/Realm.java",
            "function":  "parseWWWAuthenticateHeader"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "318671422156704999009117937540330570963",
            "length":  740
        },
        "id":  "CVE-2026-107231-da36f369",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/asynchttpclient/async-http-client/commit/8376866aa9b5a7653ad19db9d472692f875caa83",
        "target":  {
            "file":  "client/src/main/java/org/asynchttpclient/Realm.java",
            "function":  "parseProxyAuthenticateHeader"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "258140707346139023342321103897529955658",
            "length":  1359
        },
        "id":  "CVE-2026-107231-dd13ad24",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/asynchttpclient/async-http-client/commit/c8d639bf6ac341d377d610a93570bcd15565f1a6",
        "target":  {
            "file":  "client/src/test/java/org/asynchttpclient/spnego/SpnegoEngineTest.java",
            "function":  "startServers"
        }
    }
]
vanir_signatures_modified 
"2026-10-28T11:04:05Z"