CVE-2026-107232
- Source
- https://cve.org/CVERecord?id=CVE-2026-107232
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107232.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-107232
- Aliases
-
- GHSA-v9f2-7rw2-gr2x
- Downstream
- Published
- 2026-10-07T21:09:03Z
- Modified
- 2026-10-28T10:51:07Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
- Summary
- AsyncHttpClient: Origin credentials sent in cleartext to a proxy that rejects the CONNECT
- Details
-
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 on 3.x and 2.16.1 on 2.x, the client infers that an HTTP proxy tunnel exists from the last request method rather than the CONNECT result. After a proxy rejects CONNECT, redirect or authentication handlers can write an origin request and its Authorization credentials onto the still-plaintext proxy connection. Basic credentials can be recovered directly, while NTLM responses may be cracked or relayed. This issue is fixed in versions 3.0.12 and 2.16.1.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-319", "CWE-441", "CWE-522" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107232.json" }- References
-
- https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-2.16.1
- https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.12
- https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-v9f2-7rw2-gr2x
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107232.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-107232
- https://github.com/AsyncHttpClient/async-http-client/commit/3a625cb892233c0a6653ac68823a25ffbc80f393
- https://github.com/AsyncHttpClient/async-http-client/commit/a87e7b8c81a6f66a4ce23cd43097fbadd1c788ea
Affected packages
Git / github.com/asynchttpclient/async-http-client
Affected ranges
- Type
- GIT
- Repo
- https://github.com/asynchttpclient/async-http-client
- Events
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "3.0.0" }, { "fixed": "3.0.12" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "introduced": "2.0.0" }, { "fixed": "2.16.1" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "fixed": "3a625cb892233c0a6653ac68823a25ffbc80f393" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "a87e7b8c81a6f66a4ce23cd43097fbadd1c788ea" } ], "source": "REFERENCES_COMMIT" }, { "original_tag": "async-http-client-project-2.16.1", "range": [ { "fixed": "d1f0ccec417092098d40242fee7dfac84bb3c21f" } ], "source": "REFERENCES_TAG" }, { "original_tag": "async-http-client-project-3.0.12", "range": [ { "fixed": "c07038b44e5206375662b46859672e8f1df9f05a" } ], "source": "REFERENCES_TAG" } ] }
Affected versions
async-http-client-project-2.*
async-http-client-project-2.0.0
async-http-client-project-2.0.1
async-http-client-project-2.0.10
async-http-client-project-2.0.11
async-http-client-project-2.0.12
async-http-client-project-2.0.13
async-http-client-project-2.0.14
async-http-client-project-2.0.15
async-http-client-project-2.0.16
async-http-client-project-2.0.17
async-http-client-project-2.0.18
async-http-client-project-2.0.19
async-http-client-project-2.0.2
async-http-client-project-2.0.20
async-http-client-project-2.0.21
async-http-client-project-2.0.22
async-http-client-project-2.0.23
async-http-client-project-2.0.24
async-http-client-project-2.0.3
async-http-client-project-2.0.4
async-http-client-project-2.0.5
async-http-client-project-2.0.6
async-http-client-project-2.0.7
async-http-client-project-2.0.8
async-http-client-project-2.0.9
async-http-client-project-2.1.0
async-http-client-project-2.1.0-RC1
async-http-client-project-2.1.0-RC2
async-http-client-project-2.1.0-RC3
async-http-client-project-2.1.0-RC4
async-http-client-project-2.1.0-alpha10
async-http-client-project-2.1.0-alpha11
async-http-client-project-2.1.0-alpha12
async-http-client-project-2.1.0-alpha13
async-http-client-project-2.1.0-alpha14
async-http-client-project-2.1.0-alpha15
async-http-client-project-2.1.0-alpha16
async-http-client-project-2.1.0-alpha17
async-http-client-project-2.1.0-alpha18
async-http-client-project-2.1.0-alpha19
async-http-client-project-2.1.0-alpha2
async-http-client-project-2.1.0-alpha20
async-http-client-project-2.1.0-alpha21
async-http-client-project-2.1.0-alpha22
async-http-client-project-2.1.0-alpha23
async-http-client-project-2.1.0-alpha24
async-http-client-project-2.1.0-alpha25
async-http-client-project-2.1.0-alpha26
async-http-client-project-2.1.0-alpha3
async-http-client-project-2.1.0-alpha4
async-http-client-project-2.1.0-alpha5
async-http-client-project-2.1.0-alpha6
async-http-client-project-2.1.0-alpha7
async-http-client-project-2.1.0-alpha8
async-http-client-project-2.1.0-alpha9
async-http-client-project-2.1.1
async-http-client-project-2.1.2
async-http-client-project-2.10.0
async-http-client-project-2.10.1
async-http-client-project-2.10.2
async-http-client-project-2.10.3
async-http-client-project-2.10.4
async-http-client-project-2.10.5
async-http-client-project-2.11.0
async-http-client-project-2.12.0
async-http-client-project-2.12.1
async-http-client-project-2.12.2
async-http-client-project-2.12.3
async-http-client-project-2.12.4
async-http-client-project-2.14.5
async-http-client-project-2.15.0
async-http-client-project-2.16.0
async-http-client-project-2.2.0
async-http-client-project-2.2.1
async-http-client-project-2.3.0
async-http-client-project-2.4.0
async-http-client-project-2.4.1
async-http-client-project-2.4.2
async-http-client-project-2.4.3
async-http-client-project-2.4.4
async-http-client-project-2.4.5
async-http-client-project-2.4.6
async-http-client-project-2.4.7
async-http-client-project-2.4.8
async-http-client-project-2.4.9
async-http-client-project-2.5.0
async-http-client-project-2.5.1
async-http-client-project-2.5.2
async-http-client-project-2.5.3
async-http-client-project-2.5.4
async-http-client-project-2.6.0
async-http-client-project-2.7.0
async-http-client-project-2.8.0
async-http-client-project-2.8.1
async-http-client-project-2.9.0
async-http-client-project-3.*
async-http-client-project-3.0.0
async-http-client-project-3.0.1
async-http-client-project-3.0.10
async-http-client-project-3.0.11
async-http-client-project-3.0.2
async-http-client-project-3.0.3
async-http-client-project-3.0.4
async-http-client-project-3.0.5
async-http-client-project-3.0.6
async-http-client-project-3.0.7
async-http-client-project-3.0.8
async-http-client-project-3.0.9
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107232.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"line_hashes": [
"93761869070226207455796861695467949788",
"60392235751534894590790569698204321708",
"260130185790249635670509730725842553868",
"71717240567445061019878881072650414546"
],
"threshold": 0.9
},
"id": "CVE-2026-107232-0bb3e3b7",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/3a625cb892233c0a6653ac68823a25ffbc80f393",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/request/NettyRequestSender.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"16563648305330296703854804808563381750",
"38592909136708029061771047172092962433",
"311440619483304705387453006649643884694",
"54167599100310125798532679329389012896"
],
"threshold": 0.9
},
"id": "CVE-2026-107232-0fce87f7",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/a87e7b8c81a6f66a4ce23cd43097fbadd1c788ea",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/handler/intercept/ConnectSuccessInterceptor.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"219246596221720898981563676126452787927",
"112413554918931264338179563940130289539",
"262908889413526511266896616639455764237"
],
"threshold": 0.9
},
"id": "CVE-2026-107232-26220b3f",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/d1f0ccec417092098d40242fee7dfac84bb3c21f",
"target": {
"file": "client/src/main/java/org/asynchttpclient/cookie/ThreadSafeCookieStore.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "21379725901883737177966744980705543401",
"length": 2029
},
"id": "CVE-2026-107232-2f2c59e8",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/a87e7b8c81a6f66a4ce23cd43097fbadd1c788ea",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/handler/intercept/Interceptors.java",
"function": "exitAfterIntercept"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"37673794956690787785247587559178540090",
"153436567179114118314431103473685608334",
"280944977232832824679361794164429679561",
"110812239077197190542688174020533236959",
"89074174079878816942423586998157580913",
"67871885159678949604267286137044003854",
"334586665915427557898617035001800838419",
"170666047334552594897636278228190318115",
"143816524246229936502537196894216881649"
],
"threshold": 0.9
},
"id": "CVE-2026-107232-3e7b9ce0",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/a87e7b8c81a6f66a4ce23cd43097fbadd1c788ea",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/handler/intercept/Interceptors.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "285914559560197298127830810253064214053",
"length": 614
},
"id": "CVE-2026-107232-5963099c",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/3a625cb892233c0a6653ac68823a25ffbc80f393",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/handler/intercept/ConnectSuccessInterceptor.java",
"function": "exitAfterHandlingConnect"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "63693764928655523307892543298557431407",
"length": 3235
},
"id": "CVE-2026-107232-68104db8",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/3a625cb892233c0a6653ac68823a25ffbc80f393",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/handler/intercept/ProxyUnauthorized407Interceptor.java",
"function": "exitAfterHandling407"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"107273277517554343281212054420636837986",
"54654309924275726154904716834255309454",
"257513153278452074688639604488618305640",
"43393248891524555857048748841520166126",
"208391176101610086453707913024690875039",
"198340654237356580420785075765551721905",
"321772139969112120197814238181622428405",
"251682050492284063488609073549919232569",
"187285261727317219636567438912622260292",
"286367217590215424589203274277553910893",
"267088930088002385014918461952755599208",
"210035316675227394887567706995071940026"
],
"threshold": 0.9
},
"id": "CVE-2026-107232-71d102be",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/3a625cb892233c0a6653ac68823a25ffbc80f393",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/NettyResponseFuture.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"278008856621515251579607918800606694243",
"183953291242655221716237922154855555814",
"114674422634256992639294696471933455974"
],
"threshold": 0.9
},
"id": "CVE-2026-107232-7a4203a7",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/3a625cb892233c0a6653ac68823a25ffbc80f393",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/handler/intercept/ProxyUnauthorized407Interceptor.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "59094825267106429361413769881106476949",
"length": 230
},
"id": "CVE-2026-107232-99566ba6",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/3a625cb892233c0a6653ac68823a25ffbc80f393",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/request/NettyRequestSender.java",
"function": "isConnectAlreadyDone"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "45694487395070613010956218757729973419",
"length": 935
},
"id": "CVE-2026-107232-9ce5ab83",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/a87e7b8c81a6f66a4ce23cd43097fbadd1c788ea",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/handler/intercept/ConnectSuccessInterceptor.java",
"function": "exitAfterHandlingConnect"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "2135940576307710754988272828278391335",
"length": 214
},
"id": "CVE-2026-107232-9d305471",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/a87e7b8c81a6f66a4ce23cd43097fbadd1c788ea",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/NettyResponseFuture.java",
"function": "terminateAndExit"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"82275060595342905259010460357307853193",
"280506142558283165666841111422601588825",
"77712513998804805706697026351337301135",
"180585766034724679964362664851934948913",
"24995150232136211658806860942635241078",
"100828779995073662584019012498915840529"
],
"threshold": 0.9
},
"id": "CVE-2026-107232-b00b081b",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/a87e7b8c81a6f66a4ce23cd43097fbadd1c788ea",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/request/NettyRequestSender.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"278008856621515251579607918800606694243",
"183953291242655221716237922154855555814",
"114674422634256992639294696471933455974"
],
"threshold": 0.9
},
"id": "CVE-2026-107232-bafe3835",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/a87e7b8c81a6f66a4ce23cd43097fbadd1c788ea",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/handler/intercept/ProxyUnauthorized407Interceptor.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"257513153278452074688639604488618305640",
"43393248891524555857048748841520166126",
"208391176101610086453707913024690875039",
"327884691781578295249573128804442464841",
"31385200168611838349165467304218239174",
"199565420838991221769431871768544332022",
"26550541233758642691318029995387673905",
"283649714061603165559112972774888037647",
"264485870307255044809485147069699478129",
"104054647401511927318062821852514562120",
"227368195243635726977469805314699646828"
],
"threshold": 0.9
},
"id": "CVE-2026-107232-bf6fd72b",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/a87e7b8c81a6f66a4ce23cd43097fbadd1c788ea",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/NettyResponseFuture.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "319981061666573934872902157208912328509",
"length": 685
},
"id": "CVE-2026-107232-c7b286ac",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/d1f0ccec417092098d40242fee7dfac84bb3c21f",
"target": {
"file": "client/src/main/java/org/asynchttpclient/cookie/ThreadSafeCookieStore.java",
"function": "add"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "62150379452472670416585926881597947612",
"length": 302
},
"id": "CVE-2026-107232-d41d95cf",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/a87e7b8c81a6f66a4ce23cd43097fbadd1c788ea",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/request/NettyRequestSender.java",
"function": "isConnectAlreadyDone"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"294843075208461594987262143168429884764",
"14090395472501993505238017664955173536",
"179662908575714399189504221828519004518",
"132552590161015904425004823624828908338",
"267843809853029553427674013474094442740",
"37673794956690787785247587559178540090",
"153436567179114118314431103473685608334",
"272295634726323453907050697366083833007",
"36959498757069919797973202761597240348",
"125536653428111829505513762503548081151",
"254197364604549747431592874813842798954",
"204126026206739983792229258023468682639",
"246413244827875785941536374390780553732"
],
"threshold": 0.9
},
"id": "CVE-2026-107232-f10025bc",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/3a625cb892233c0a6653ac68823a25ffbc80f393",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/handler/intercept/Interceptors.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "269250702260740025704605238512407229919",
"length": 6790
},
"id": "CVE-2026-107232-f6552106",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/a87e7b8c81a6f66a4ce23cd43097fbadd1c788ea",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/handler/intercept/ProxyUnauthorized407Interceptor.java",
"function": "exitAfterHandling407"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "258959195040057388164691616724563276093",
"length": 1427
},
"id": "CVE-2026-107232-fe1724ab",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/3a625cb892233c0a6653ac68823a25ffbc80f393",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/handler/intercept/Interceptors.java",
"function": "exitAfterIntercept"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"5921086235920099630140853148418192862",
"48047145311673591808078576235992775626",
"156298071544090071256163607185212901980"
],
"threshold": 0.9
},
"id": "CVE-2026-107232-fed3d4cc",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/3a625cb892233c0a6653ac68823a25ffbc80f393",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/handler/intercept/ConnectSuccessInterceptor.java"
}
}
]
vanir_signatures_modified
"2026-10-28T10:51:07Z"