CVE-2026-85718
- Source
- https://cve.org/CVERecord?id=CVE-2026-85718
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-85718.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-85718
- Aliases
-
- GHSA-gcmv-gr82-6m8v
- Downstream
- Published
- 2026-09-17T15:58:40Z
- Modified
- 2026-10-02T08:13:38Z
- Severity
-
- 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- AsyncHttpClient: Connection permit leak on TLS handshake failure causes per-host denial of service
- Details
-
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 3.0.8 until 3.0.12, a client with maxConnections or maxConnectionsPerHost set above zero leaks one connection permit whenever TLS connection establishment fails before the handshake completes. NettyConnectListener removes the partitionKeyLock permit from NettyResponseFuture before every failure path is bound to the channel closeFuture, so an abort can leave the permit unreleased. Repeated failures can permanently lock out one host under a per-host limit or drain the shared pool under a global limit, blocking later requests even when no connection remains open. The default unlimited connection setting is not affected. This issue is fixed in version 3.0.12.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-400", "CWE-772" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85718.json" }- References
-
- https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-gcmv-gr82-6m8v
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85718.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-85718
- https://github.com/AsyncHttpClient/async-http-client/issues/2189
- https://github.com/AsyncHttpClient/async-http-client/commit/64eb57af52a003ae7f29a2f9f4502271bbb138dd
- https://github.com/AsyncHttpClient/async-http-client/pull/2288
Affected packages
Git / github.com/asynchttpclient/async-http-client
Affected versions
async-http-client-project-3.*
async-http-client-project-3.0.10
async-http-client-project-3.0.11
async-http-client-project-3.0.8
async-http-client-project-3.0.9
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-85718.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"function_hash": "196027413138421576544923504097391731312",
"length": 947
},
"id": "CVE-2026-85718-1baeb146",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/64eb57af52a003ae7f29a2f9f4502271bbb138dd",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/handler/WebSocketHandler.java",
"function": "handleRead"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "323897995376002767097149729788076154825",
"length": 785
},
"id": "CVE-2026-85718-1e5eb5fd",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/64eb57af52a003ae7f29a2f9f4502271bbb138dd",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/channel/NettyConnectListener.java",
"function": "onSuccess"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"325842780222119120694864714580923725820",
"144476454551410915517511036748403454814",
"42945676031269476070354127543984507500",
"147298643795838512451403638683780751377",
"58042043332772384813537508909587362979",
"94933897831066738403219268502757810445",
"129463267634944132091188343012093037814",
"6688451910908019767232083447948692712",
"211983761413302267650470330490190712640",
"33262756390579870557523004445172275026",
"315413332675930497814774101693142771124",
"83142534775204943859296743393154588777",
"9589910314172936281843885916841808143",
"276968780569524240709252967154434088817",
"196104997004530985951640694482209346714",
"279455911329397849651305084829901240766",
"16914442054602945998893145890785682878",
"42947707039898969968716785891777636711",
"337545222806700587263574668705962384275",
"104459135317475068380758664857438217413",
"319438233390316511553204103090125239431",
"11087683038869665472955337362137447678",
"198877132574590538876444483467884322082",
"102787782609799214661728617667424636052",
"208957668583892948845430178276248122719",
"254366338821783314709468833454142248498",
"324730744498473428015769412682067032068",
"312717986267295716816947598012589899223",
"73276055914977291289167534211556354333",
"188791236929510505519557251370227924545",
"175546871484813593794483764751841481250",
"26444047505345104971004111540009977758",
"276263350509738179426792355704181938620",
"151077040057360693032207478247617326108",
"75778025297124256029321549565938667786",
"188791236929510505519557251370227924545",
"175546871484813593794483764751841481250",
"26444047505345104971004111540009977758",
"276263350509738179426792355704181938620",
"85603455279577846210680096067399230725",
"257869823140461350565062003507067275891",
"243015910726492699708447916035694533658",
"219487397388640163693144849227879016981",
"232602618295542271683540891770518465927",
"278608724016429377466445137621916240291",
"91138795202605821463983588431682993746",
"36435795867046302336444607069923789972",
"262761465608903064895036102952002489452",
"117732744617574481874821897455588844665",
"19719988500143636565758559308078572632",
"213056300292443474321128082108912039480",
"65928301948260492021106859756273286233",
"164265014320626295114266119592077150365",
"225006976112029557810541467836574081583",
"160958225560525712738445943072555978136",
"163946613733298143253576728824206909405",
"240394676639512748826975707547958594457",
"21183142177609988128185961128864752013",
"318317264247392950277440220224202701778",
"237952070272126713314727802278021212804",
"8152964889785250071420602465324789891",
"98581131446769826125162406082981082364",
"198100749751240908366854827695184402317",
"173595491939238351977115765231847692663",
"41887019721233851300525273837198114005",
"76343719851065791138284149083614023606"
],
"threshold": 0.9
},
"id": "CVE-2026-85718-1ef39914",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/64eb57af52a003ae7f29a2f9f4502271bbb138dd",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/channel/NettyConnectListener.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "119519489522831767192653961636055735819",
"length": 373
},
"id": "CVE-2026-85718-2fd9bcd8",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/64eb57af52a003ae7f29a2f9f4502271bbb138dd",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/request/NettyRequestSender.java",
"function": "abort"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"201063284443801175914816473961269260203",
"129587120852179523183277495286645593525",
"297178502086819264756384334986057296279",
"22005734590685897727785608623726588188"
],
"threshold": 0.9
},
"id": "CVE-2026-85718-43de5acb",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/64eb57af52a003ae7f29a2f9f4502271bbb138dd",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/handler/WebSocketHandler.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "10796317595209658220587284677363931696",
"length": 436
},
"id": "CVE-2026-85718-5040909f",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/64eb57af52a003ae7f29a2f9f4502271bbb138dd",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/channel/NettyConnectListener.java",
"function": "writeRequest"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"112064229818690970156901529102132934551",
"167476450270760629694497093551044143716",
"93924983961486190788050819632653596052",
"221160228808876490140860203244298724033",
"323481125317136313543977058599762617879",
"220105586556796198624753949468419697877",
"145795774004069866879401004965810128668",
"65431713869422250275145606262265391601",
"51936732102319741190398127599615908222",
"195772382709730327089211071947885651329",
"330942146427551361667279031236179366306",
"288963303491205404234836376783780342061",
"312000856753652533940354228066008522556",
"132215018681642116285720703294796213541"
],
"threshold": 0.9
},
"id": "CVE-2026-85718-57d46370",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/64eb57af52a003ae7f29a2f9f4502271bbb138dd",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/request/NettyRequestSender.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "311173479416976941283668209405074969353",
"length": 504
},
"id": "CVE-2026-85718-7295b77c",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/64eb57af52a003ae7f29a2f9f4502271bbb138dd",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/channel/NettyConnectListener.java",
"function": "registerHttp2AndManageSemaphore"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "313273141917795971990329655386154779675",
"length": 330
},
"id": "CVE-2026-85718-7389e525",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/64eb57af52a003ae7f29a2f9f4502271bbb138dd",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/channel/NettyConnectListener.java",
"function": "onSuccess"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "334915199273695004749856591512150808223",
"length": 133
},
"id": "CVE-2026-85718-990bb08a",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/64eb57af52a003ae7f29a2f9f4502271bbb138dd",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/channel/NettyConnectListener.java",
"function": "releaseSemaphoreImmediately"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "219148741212908299989498318949536192051",
"length": 354
},
"id": "CVE-2026-85718-9aeea455",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/64eb57af52a003ae7f29a2f9f4502271bbb138dd",
"target": {
"file": "client/src/test/java/org/asynchttpclient/netty/channel/ChannelManagerHttp2DrainPermitTest.java",
"function": "registerRrConnectionHoldingPermit"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "323106539594753562434666246839715198699",
"length": 188
},
"id": "CVE-2026-85718-bcb12ce9",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/64eb57af52a003ae7f29a2f9f4502271bbb138dd",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/channel/NettyConnectListener.java",
"function": "attachSemaphoreToChannelClose"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"224312697026182864093590956792251859616",
"107949834261980398093281576869151868556",
"67498109445622137850446722079651478565",
"289352688899057706270746778984273831641",
"96002679735668409091128038956349052823"
],
"threshold": 0.9
},
"id": "CVE-2026-85718-d4fd30ef",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/64eb57af52a003ae7f29a2f9f4502271bbb138dd",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/NettyResponseFuture.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "215960977796734930890554147867446844250",
"length": 3719
},
"id": "CVE-2026-85718-d5832d16",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/64eb57af52a003ae7f29a2f9f4502271bbb138dd",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/channel/NettyConnectListener.java",
"function": "onSuccess"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"67610824872663320368392653783548117872",
"29021653386288268656414247038393100912",
"52754198249756284649227791639139274972",
"302216725893495499632681537687326445249",
"232517323986801430712959914091256444532",
"92464807306352383767592955121686677748",
"235617983700805902310918981697775802018",
"175297538642861920071044016492155662270",
"115563747691719887518605836041739228140"
],
"threshold": 0.9
},
"id": "CVE-2026-85718-e73f0511",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/64eb57af52a003ae7f29a2f9f4502271bbb138dd",
"target": {
"file": "client/src/test/java/org/asynchttpclient/netty/channel/ChannelManagerHttp2DrainPermitTest.java"
}
}
]
vanir_signatures_modified
"2026-10-02T08:13:38Z"