CVE-2026-107285

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-107285
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107285.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-107285
Aliases
Downstream
CLSA (1)
DEBIAN (1)
ECHO (1)
MINI (4)
UBUNTU (1)
Published
2026-10-07T21:28:34Z
Modified
2026-10-28T11:06:05Z
Severity
  • 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel
Details

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, a proxied ws request is carried through CONNECT, but NettyRequestFactory.newNettyRequest and requestUri decide whether to attach proxy authentication and an absolute-form target only from whether the URI is secure. Because ws is not marked secure, the tunneled WebSocket upgrade sent to the origin includes the proxy's Proxy-Authorization value. Basic credentials are directly recoverable and Digest responses can be replayed or cracked offline. This issue is fixed in versions 3.0.12 and 2.16.1.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-319",
        "CWE-522"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107285.json"
}
References

Affected packages

Git / github.com/asynchttpclient/async-http-client

Affected ranges

Type
GIT
Repo
https://github.com/asynchttpclient/async-http-client
Events
Introduced
9a771c7b40e716ca77a3cad691545b29ff64bfd3
Fixed
c07038b44e5206375662b46859672e8f1df9f05a
Introduced
b60e5a0d7d989e4a24c13e03ba786c375b727448
Fixed
d1f0ccec417092098d40242fee7dfac84bb3c21f
Fixed
6e9cb75a9b7259353f983fc90ca28b1da3742e18
Fixed
c4feab0f7f86d61505a48e40d383c8a375a22e18
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "3.0.0"
                },
                {
                    "fixed":  "3.0.12"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "introduced":  "2.0.0"
                },
                {
                    "fixed":  "2.16.1"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "fixed":  "6e9cb75a9b7259353f983fc90ca28b1da3742e18"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "range":  [
                {
                    "fixed":  "c4feab0f7f86d61505a48e40d383c8a375a22e18"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "async-http-client-project-2.16.1",
            "range":  [
                {
                    "fixed":  "d1f0ccec417092098d40242fee7dfac84bb3c21f"
                }
            ],
            "source":  "REFERENCES_TAG"
        },
        {
            "original_tag":  "async-http-client-project-3.0.12",
            "range":  [
                {
                    "fixed":  "c07038b44e5206375662b46859672e8f1df9f05a"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

async-http-client-project-2.*
async-http-client-project-2.0.0
async-http-client-project-2.0.1
async-http-client-project-2.0.10
async-http-client-project-2.0.11
async-http-client-project-2.0.12
async-http-client-project-2.0.13
async-http-client-project-2.0.14
async-http-client-project-2.0.15
async-http-client-project-2.0.16
async-http-client-project-2.0.17
async-http-client-project-2.0.18
async-http-client-project-2.0.19
async-http-client-project-2.0.2
async-http-client-project-2.0.20
async-http-client-project-2.0.21
async-http-client-project-2.0.22
async-http-client-project-2.0.23
async-http-client-project-2.0.24
async-http-client-project-2.0.3
async-http-client-project-2.0.4
async-http-client-project-2.0.5
async-http-client-project-2.0.6
async-http-client-project-2.0.7
async-http-client-project-2.0.8
async-http-client-project-2.0.9
async-http-client-project-2.1.0
async-http-client-project-2.1.0-RC1
async-http-client-project-2.1.0-RC2
async-http-client-project-2.1.0-RC3
async-http-client-project-2.1.0-RC4
async-http-client-project-2.1.0-alpha10
async-http-client-project-2.1.0-alpha11
async-http-client-project-2.1.0-alpha12
async-http-client-project-2.1.0-alpha13
async-http-client-project-2.1.0-alpha14
async-http-client-project-2.1.0-alpha15
async-http-client-project-2.1.0-alpha16
async-http-client-project-2.1.0-alpha17
async-http-client-project-2.1.0-alpha18
async-http-client-project-2.1.0-alpha19
async-http-client-project-2.1.0-alpha2
async-http-client-project-2.1.0-alpha20
async-http-client-project-2.1.0-alpha21
async-http-client-project-2.1.0-alpha22
async-http-client-project-2.1.0-alpha23
async-http-client-project-2.1.0-alpha24
async-http-client-project-2.1.0-alpha25
async-http-client-project-2.1.0-alpha26
async-http-client-project-2.1.0-alpha3
async-http-client-project-2.1.0-alpha4
async-http-client-project-2.1.0-alpha5
async-http-client-project-2.1.0-alpha6
async-http-client-project-2.1.0-alpha7
async-http-client-project-2.1.0-alpha8
async-http-client-project-2.1.0-alpha9
async-http-client-project-2.1.1
async-http-client-project-2.1.2
async-http-client-project-2.10.0
async-http-client-project-2.10.1
async-http-client-project-2.10.2
async-http-client-project-2.10.3
async-http-client-project-2.10.4
async-http-client-project-2.10.5
async-http-client-project-2.11.0
async-http-client-project-2.12.0
async-http-client-project-2.12.1
async-http-client-project-2.12.2
async-http-client-project-2.12.3
async-http-client-project-2.12.4
async-http-client-project-2.14.5
async-http-client-project-2.15.0
async-http-client-project-2.16.0
async-http-client-project-2.2.0
async-http-client-project-2.2.1
async-http-client-project-2.3.0
async-http-client-project-2.4.0
async-http-client-project-2.4.1
async-http-client-project-2.4.2
async-http-client-project-2.4.3
async-http-client-project-2.4.4
async-http-client-project-2.4.5
async-http-client-project-2.4.6
async-http-client-project-2.4.7
async-http-client-project-2.4.8
async-http-client-project-2.4.9
async-http-client-project-2.5.0
async-http-client-project-2.5.1
async-http-client-project-2.5.2
async-http-client-project-2.5.3
async-http-client-project-2.5.4
async-http-client-project-2.6.0
async-http-client-project-2.7.0
async-http-client-project-2.8.0
async-http-client-project-2.8.1
async-http-client-project-2.9.0
async-http-client-project-3.*
async-http-client-project-3.0.0
async-http-client-project-3.0.1
async-http-client-project-3.0.10
async-http-client-project-3.0.11
async-http-client-project-3.0.2
async-http-client-project-3.0.3
async-http-client-project-3.0.4
async-http-client-project-3.0.5
async-http-client-project-3.0.6
async-http-client-project-3.0.7
async-http-client-project-3.0.8
async-http-client-project-3.0.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107285.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "153204997515736775817011448566005629958",
            "length":  3191
        },
        "id":  "CVE-2026-107285-063deec7",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/asynchttpclient/async-http-client/commit/c4feab0f7f86d61505a48e40d383c8a375a22e18",
        "target":  {
            "file":  "client/src/main/java/org/asynchttpclient/netty/request/NettyRequestFactory.java",
            "function":  "newNettyRequest"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "219246596221720898981563676126452787927",
                "112413554918931264338179563940130289539",
                "262908889413526511266896616639455764237"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-107285-26220b3f",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/asynchttpclient/async-http-client/commit/d1f0ccec417092098d40242fee7dfac84bb3c21f",
        "target":  {
            "file":  "client/src/main/java/org/asynchttpclient/cookie/ThreadSafeCookieStore.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "122898248226453636633573107295086274707",
                "89260560455226747166459592506138825414",
                "28932288927280610880481399526949048463",
                "135142761551885042616728788624804661145",
                "200364604885625207178607263731397467666",
                "127275896700825300653346032680110428292",
                "69055472436110395494553243539436041772",
                "179065408617250721794683188122443742196"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-107285-5fc46b44",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/asynchttpclient/async-http-client/commit/c4feab0f7f86d61505a48e40d383c8a375a22e18",
        "target":  {
            "file":  "client/src/main/java/org/asynchttpclient/netty/request/NettyRequestFactory.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "52525402537925952284433710853798245891",
            "length":  273
        },
        "id":  "CVE-2026-107285-6d96b944",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/asynchttpclient/async-http-client/commit/6e9cb75a9b7259353f983fc90ca28b1da3742e18",
        "target":  {
            "file":  "client/src/main/java/org/asynchttpclient/netty/request/NettyRequestFactory.java",
            "function":  "requestUri"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "162349297726815360820203398563939708623",
            "length":  3536
        },
        "id":  "CVE-2026-107285-753ee8de",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/asynchttpclient/async-http-client/commit/6e9cb75a9b7259353f983fc90ca28b1da3742e18",
        "target":  {
            "file":  "client/src/main/java/org/asynchttpclient/netty/request/NettyRequestFactory.java",
            "function":  "newNettyRequest"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "52525402537925952284433710853798245891",
            "length":  273
        },
        "id":  "CVE-2026-107285-9f28926a",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/asynchttpclient/async-http-client/commit/c4feab0f7f86d61505a48e40d383c8a375a22e18",
        "target":  {
            "file":  "client/src/main/java/org/asynchttpclient/netty/request/NettyRequestFactory.java",
            "function":  "requestUri"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "319981061666573934872902157208912328509",
            "length":  685
        },
        "id":  "CVE-2026-107285-c7b286ac",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/asynchttpclient/async-http-client/commit/d1f0ccec417092098d40242fee7dfac84bb3c21f",
        "target":  {
            "file":  "client/src/main/java/org/asynchttpclient/cookie/ThreadSafeCookieStore.java",
            "function":  "add"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "284972402889713369605029111619160186164",
                "68264258969207262225253499450820122956",
                "5548367421419778026756654184901718444",
                "292128091156312128285088192886876109228",
                "249485075517770022476603193187687324423",
                "48741397359840370099643328266727015247",
                "145549231500374596712921482233272709507",
                "90994857250392584915878046338010882219"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-107285-c80f221a",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/asynchttpclient/async-http-client/commit/6e9cb75a9b7259353f983fc90ca28b1da3742e18",
        "target":  {
            "file":  "client/src/main/java/org/asynchttpclient/netty/request/NettyRequestFactory.java"
        }
    }
]
vanir_signatures_modified 
"2026-10-28T11:06:05Z"