CVE-2026-85719

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-85719
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-85719.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-85719
Aliases
  • GHSA-x5w6-vm3f-pp6f
Published
2026-09-17T15:52:16Z
Modified
2026-09-18T08:05:16Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
AsyncHttpClient: SOCKS proxy credentials sent to the origin server over plaintext HTTP
Details

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 2.16.1 and 3.0.12, requests using an authenticated SOCKS proxy can expose the proxy's credentials to the origin because NettyRequestFactory and NettyRequestSender attach Proxy-Authorization without confirming that the request is being sent to an HTTP proxy. With preemptive proxy authentication, the header is attached to a plaintext HTTP request, exposing credentials such as directly reversible Basic credentials to the origin. With the default non-preemptive flow, a hostile origin can return a 407 response and ProxyUnauthorized407Interceptor sends the proxy credentials through the existing SOCKS tunnel, including NTLM, Kerberos, and SPNEGO credentials. Releases before 2.1.0 lack SOCKS proxy support. This issue is fixed in versions 2.16.1 and 3.0.12.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-319",
        "CWE-522"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85719.json"
}
References

Affected packages

Git / github.com/asynchttpclient/async-http-client

Affected ranges

Type
GIT
Repo
https://github.com/asynchttpclient/async-http-client
Events
Introduced
927333da38413759027ccc22a93621da21e7468a
Fixed
d1f0ccec417092098d40242fee7dfac84bb3c21f
Introduced
9a771c7b40e716ca77a3cad691545b29ff64bfd3
Fixed
c07038b44e5206375662b46859672e8f1df9f05a
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "2.1.0"
        },
        {
            "fixed": "2.16.1"
        },
        {
            "introduced": "3.0.0"
        },
        {
            "fixed": "3.0.12"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

async-http-client-project-2.*
async-http-client-project-2.1.0
async-http-client-project-2.1.1
async-http-client-project-2.1.2
async-http-client-project-2.10.0
async-http-client-project-2.10.1
async-http-client-project-2.10.2
async-http-client-project-2.10.3
async-http-client-project-2.10.4
async-http-client-project-2.10.5
async-http-client-project-2.11.0
async-http-client-project-2.12.0
async-http-client-project-2.12.1
async-http-client-project-2.12.2
async-http-client-project-2.12.3
async-http-client-project-2.12.4
async-http-client-project-2.14.5
async-http-client-project-2.15.0
async-http-client-project-2.16.0
async-http-client-project-2.2.0
async-http-client-project-2.2.1
async-http-client-project-2.3.0
async-http-client-project-2.4.0
async-http-client-project-2.4.1
async-http-client-project-2.4.2
async-http-client-project-2.4.3
async-http-client-project-2.4.4
async-http-client-project-2.4.5
async-http-client-project-2.4.6
async-http-client-project-2.4.7
async-http-client-project-2.4.8
async-http-client-project-2.4.9
async-http-client-project-2.5.0
async-http-client-project-2.5.1
async-http-client-project-2.5.2
async-http-client-project-2.5.3
async-http-client-project-2.5.4
async-http-client-project-2.6.0
async-http-client-project-2.7.0
async-http-client-project-2.8.0
async-http-client-project-2.8.1
async-http-client-project-2.9.0
async-http-client-project-3.*
async-http-client-project-3.0.0
async-http-client-project-3.0.1
async-http-client-project-3.0.10
async-http-client-project-3.0.11
async-http-client-project-3.0.2
async-http-client-project-3.0.3
async-http-client-project-3.0.4
async-http-client-project-3.0.5
async-http-client-project-3.0.6
async-http-client-project-3.0.7
async-http-client-project-3.0.8
async-http-client-project-3.0.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-85719.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "219246596221720898981563676126452787927",
                "112413554918931264338179563940130289539",
                "262908889413526511266896616639455764237"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-85719-26220b3f",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/asynchttpclient/async-http-client/commit/d1f0ccec417092098d40242fee7dfac84bb3c21f",
        "target": {
            "file": "client/src/main/java/org/asynchttpclient/cookie/ThreadSafeCookieStore.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "319981061666573934872902157208912328509",
            "length": 685
        },
        "id": "CVE-2026-85719-c7b286ac",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/asynchttpclient/async-http-client/commit/d1f0ccec417092098d40242fee7dfac84bb3c21f",
        "target": {
            "file": "client/src/main/java/org/asynchttpclient/cookie/ThreadSafeCookieStore.java",
            "function": "add"
        }
    }
]
vanir_signatures_modified 
"2026-09-18T08:05:16Z"