CVE-2026-107284

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-107284

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107284.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-107284

Aliases

GHSA-rwhr-j9rv-85f8

Downstream

Published

2026-10-07T21:27:03Z

Modified

2026-10-08T13:03:49Z

Severity

3.7 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator

Summary

AsyncHttpClient: WebSocket handshake continues after a failed Sec-WebSocket-Accept check

Details

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, WebSocketHandler.upgrade aborts a handshake whose Sec-WebSocket-Accept value is missing or invalid but continues into pipeline installation and onOpen delivery. Frames coalesced with the invalid 101 response can be decoded and delivered from a peer that did not prove the handshake, although the request future fails and the channel closes. This issue is fixed in versions 3.0.12 and 2.16.1.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-345",
        "CWE-670"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107284.json"
}

References

Affected packages

Git / github.com/asynchttpclient/async-http-client

Affected ranges

Type

GIT

Repo

https://github.com/asynchttpclient/async-http-client

Events

Introduced

9a771c7b40e716ca77a3cad691545b29ff64bfd3

Fixed

c07038b44e5206375662b46859672e8f1df9f05a

Introduced

b60e5a0d7d989e4a24c13e03ba786c375b727448

Fixed

d1f0ccec417092098d40242fee7dfac84bb3c21f

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "3.0.0"
        },
        {
            "fixed": "3.0.12"
        },
        {
            "introduced": "2.0.0"
        },
        {
            "fixed": "2.16.1"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

async-http-client-project-2.*

async-http-client-project-2.0.0

async-http-client-project-2.0.1

async-http-client-project-2.0.10

async-http-client-project-2.0.11

async-http-client-project-2.0.12

async-http-client-project-2.0.13

async-http-client-project-2.0.14

async-http-client-project-2.0.15

async-http-client-project-2.0.16

async-http-client-project-2.0.17

async-http-client-project-2.0.18

async-http-client-project-2.0.19

async-http-client-project-2.0.2

async-http-client-project-2.0.20

async-http-client-project-2.0.21

async-http-client-project-2.0.22

async-http-client-project-2.0.23

async-http-client-project-2.0.24

async-http-client-project-2.0.3

async-http-client-project-2.0.4

async-http-client-project-2.0.5

async-http-client-project-2.0.6

async-http-client-project-2.0.7

async-http-client-project-2.0.8

async-http-client-project-2.0.9

async-http-client-project-2.1.0

async-http-client-project-2.1.0-RC1

async-http-client-project-2.1.0-RC2

async-http-client-project-2.1.0-RC3

async-http-client-project-2.1.0-RC4

async-http-client-project-2.1.0-alpha10

async-http-client-project-2.1.0-alpha11

async-http-client-project-2.1.0-alpha12

async-http-client-project-2.1.0-alpha13

async-http-client-project-2.1.0-alpha14

async-http-client-project-2.1.0-alpha15

async-http-client-project-2.1.0-alpha16

async-http-client-project-2.1.0-alpha17

async-http-client-project-2.1.0-alpha18

async-http-client-project-2.1.0-alpha19

async-http-client-project-2.1.0-alpha2

async-http-client-project-2.1.0-alpha20

async-http-client-project-2.1.0-alpha21

async-http-client-project-2.1.0-alpha22

async-http-client-project-2.1.0-alpha23

async-http-client-project-2.1.0-alpha24

async-http-client-project-2.1.0-alpha25

async-http-client-project-2.1.0-alpha26

async-http-client-project-2.1.0-alpha3

async-http-client-project-2.1.0-alpha4

async-http-client-project-2.1.0-alpha5

async-http-client-project-2.1.0-alpha6

async-http-client-project-2.1.0-alpha7

async-http-client-project-2.1.0-alpha8

async-http-client-project-2.1.0-alpha9

async-http-client-project-2.1.1

async-http-client-project-2.1.2

async-http-client-project-2.10.0

async-http-client-project-2.10.1

async-http-client-project-2.10.2

async-http-client-project-2.10.3

async-http-client-project-2.10.4

async-http-client-project-2.10.5

async-http-client-project-2.11.0

async-http-client-project-2.12.0

async-http-client-project-2.12.1

async-http-client-project-2.12.2

async-http-client-project-2.12.3

async-http-client-project-2.12.4

async-http-client-project-2.14.5

async-http-client-project-2.15.0

async-http-client-project-2.16.0

async-http-client-project-2.2.0

async-http-client-project-2.2.1

async-http-client-project-2.3.0

async-http-client-project-2.4.0

async-http-client-project-2.4.1

async-http-client-project-2.4.2

async-http-client-project-2.4.3

async-http-client-project-2.4.4

async-http-client-project-2.4.5

async-http-client-project-2.4.6

async-http-client-project-2.4.7

async-http-client-project-2.4.8

async-http-client-project-2.4.9

async-http-client-project-2.5.0

async-http-client-project-2.5.1

async-http-client-project-2.5.2

async-http-client-project-2.5.3

async-http-client-project-2.5.4

async-http-client-project-2.6.0

async-http-client-project-2.7.0

async-http-client-project-2.8.0

async-http-client-project-2.8.1

async-http-client-project-2.9.0

async-http-client-project-3.*

async-http-client-project-3.0.0

async-http-client-project-3.0.1

async-http-client-project-3.0.10

async-http-client-project-3.0.11

async-http-client-project-3.0.2

async-http-client-project-3.0.3

async-http-client-project-3.0.4

async-http-client-project-3.0.5

async-http-client-project-3.0.6

async-http-client-project-3.0.7

async-http-client-project-3.0.8

async-http-client-project-3.0.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107284.json"

vanir_signatures

[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "219246596221720898981563676126452787927",
                "112413554918931264338179563940130289539",
                "262908889413526511266896616639455764237"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-107284-26220b3f",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/asynchttpclient/async-http-client/commit/d1f0ccec417092098d40242fee7dfac84bb3c21f",
        "target": {
            "file": "client/src/main/java/org/asynchttpclient/cookie/ThreadSafeCookieStore.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "319981061666573934872902157208912328509",
            "length": 685
        },
        "id": "CVE-2026-107284-c7b286ac",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/asynchttpclient/async-http-client/commit/d1f0ccec417092098d40242fee7dfac84bb3c21f",
        "target": {
            "file": "client/src/main/java/org/asynchttpclient/cookie/ThreadSafeCookieStore.java",
            "function": "add"
        }
    }
]

vanir_signatures_modified

"2026-10-08T13:03:49Z"