CVE-2026-85719
- Source
- https://cve.org/CVERecord?id=CVE-2026-85719
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-85719.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-85719
- Aliases
-
- GHSA-x5w6-vm3f-pp6f
- Downstream
- Published
- 2026-09-17T15:52:16Z
- Modified
- 2026-10-28T11:18:55Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
- Summary
- AsyncHttpClient: SOCKS proxy credentials sent to the origin server over plaintext HTTP
- Details
-
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 2.16.1 and 3.0.12, requests using an authenticated SOCKS proxy can expose the proxy's credentials to the origin because NettyRequestFactory and NettyRequestSender attach Proxy-Authorization without confirming that the request is being sent to an HTTP proxy. With preemptive proxy authentication, the header is attached to a plaintext HTTP request, exposing credentials such as directly reversible Basic credentials to the origin. With the default non-preemptive flow, a hostile origin can return a 407 response and ProxyUnauthorized407Interceptor sends the proxy credentials through the existing SOCKS tunnel, including NTLM, Kerberos, and SPNEGO credentials. Releases before 2.1.0 lack SOCKS proxy support. This issue is fixed in versions 2.16.1 and 3.0.12.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-319", "CWE-522" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85719.json" }- References
-
- https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-x5w6-vm3f-pp6f
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85719.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-85719
- https://github.com/AsyncHttpClient/async-http-client/commit/4d887704dec22027310f66c81503226722e9bd23
- https://github.com/AsyncHttpClient/async-http-client/commit/718ed2e86126663a88ea3db7a88cbbf93f0069b5
- https://github.com/AsyncHttpClient/async-http-client/commit/abaa8bd260beda3b85825ff95069ed11eaf4ca8d
- https://github.com/AsyncHttpClient/async-http-client/commit/be439b2ec773d12d61914c238d3e8eeaa6f0ba21
Affected packages
Git / github.com/asynchttpclient/async-http-client
Affected ranges
- Type
- GIT
- Repo
- https://github.com/asynchttpclient/async-http-client
- Events
-
IntroducedFixedIntroducedFixedFixedFixedFixedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "2.1.0" }, { "fixed": "2.16.1" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "introduced": "3.0.0" }, { "fixed": "3.0.12" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "fixed": "4d887704dec22027310f66c81503226722e9bd23" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "718ed2e86126663a88ea3db7a88cbbf93f0069b5" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "abaa8bd260beda3b85825ff95069ed11eaf4ca8d" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "be439b2ec773d12d61914c238d3e8eeaa6f0ba21" } ], "source": "REFERENCES_COMMIT" } ] }
Affected versions
async-http-client-project-2.*
async-http-client-project-2.1.0
async-http-client-project-2.1.1
async-http-client-project-2.1.2
async-http-client-project-2.10.0
async-http-client-project-2.10.1
async-http-client-project-2.10.2
async-http-client-project-2.10.3
async-http-client-project-2.10.4
async-http-client-project-2.10.5
async-http-client-project-2.11.0
async-http-client-project-2.12.0
async-http-client-project-2.12.1
async-http-client-project-2.12.2
async-http-client-project-2.12.3
async-http-client-project-2.12.4
async-http-client-project-2.14.5
async-http-client-project-2.15.0
async-http-client-project-2.16.0
async-http-client-project-2.2.0
async-http-client-project-2.2.1
async-http-client-project-2.3.0
async-http-client-project-2.4.0
async-http-client-project-2.4.1
async-http-client-project-2.4.2
async-http-client-project-2.4.3
async-http-client-project-2.4.4
async-http-client-project-2.4.5
async-http-client-project-2.4.6
async-http-client-project-2.4.7
async-http-client-project-2.4.8
async-http-client-project-2.4.9
async-http-client-project-2.5.0
async-http-client-project-2.5.1
async-http-client-project-2.5.2
async-http-client-project-2.5.3
async-http-client-project-2.5.4
async-http-client-project-2.6.0
async-http-client-project-2.7.0
async-http-client-project-2.8.0
async-http-client-project-2.8.1
async-http-client-project-2.9.0
async-http-client-project-3.*
async-http-client-project-3.0.0
async-http-client-project-3.0.1
async-http-client-project-3.0.10
async-http-client-project-3.0.11
async-http-client-project-3.0.2
async-http-client-project-3.0.3
async-http-client-project-3.0.4
async-http-client-project-3.0.5
async-http-client-project-3.0.6
async-http-client-project-3.0.7
async-http-client-project-3.0.8
async-http-client-project-3.0.9
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-85719.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"function_hash": "30388741910355905084714514497844969559",
"length": 3131
},
"id": "CVE-2026-85719-0015c659",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/718ed2e86126663a88ea3db7a88cbbf93f0069b5",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/request/NettyRequestFactory.java",
"function": "newNettyRequest"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "118560897874146855116363100856230583254",
"length": 2235
},
"id": "CVE-2026-85719-04213b99",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/4d887704dec22027310f66c81503226722e9bd23",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/request/NettyRequestSender.java",
"function": "sendRequestWithNewChannel"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "109109892798799702882908121781014650566",
"length": 460
},
"id": "CVE-2026-85719-0cb557f1",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/be439b2ec773d12d61914c238d3e8eeaa6f0ba21",
"target": {
"file": "client/src/test/java/org/asynchttpclient/proxy/ConnectTunnelStateTest.java",
"function": "handle"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"219246596221720898981563676126452787927",
"112413554918931264338179563940130289539",
"262908889413526511266896616639455764237"
],
"threshold": 0.9
},
"id": "CVE-2026-85719-26220b3f",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/d1f0ccec417092098d40242fee7dfac84bb3c21f",
"target": {
"file": "client/src/main/java/org/asynchttpclient/cookie/ThreadSafeCookieStore.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"30974813251755625490091577007397111563",
"37127981804501176559993173529701370388",
"215078661925119268690153015037928107565",
"176318263283337904857816818441240556781",
"73569229456212238906998538252743653484",
"18664510245267070956483152212014109500",
"29314381843718149662718973408795695468"
],
"threshold": 0.9
},
"id": "CVE-2026-85719-3239e2e9",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/abaa8bd260beda3b85825ff95069ed11eaf4ca8d",
"target": {
"file": "client/src/test/java/org/asynchttpclient/netty/handler/intercept/ProxyUnauthorized407InterceptorTest.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "32025131427628564061791587300261783784",
"length": 6966
},
"id": "CVE-2026-85719-3a6a8011",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/be439b2ec773d12d61914c238d3e8eeaa6f0ba21",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/handler/intercept/ProxyUnauthorized407Interceptor.java",
"function": "exitAfterHandling407"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"100585575953334963801176949225715524957",
"72915125250720726865127628235865656531",
"320777125038522400883816160272241022188",
"327621898328585423520478771504408365137"
],
"threshold": 0.9
},
"id": "CVE-2026-85719-46c6ef1c",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/718ed2e86126663a88ea3db7a88cbbf93f0069b5",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/request/NettyRequestSender.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "295879694154284430052451581251397362654",
"length": 3476
},
"id": "CVE-2026-85719-48ee94fa",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/4d887704dec22027310f66c81503226722e9bd23",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/request/NettyRequestFactory.java",
"function": "newNettyRequest"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "31361425404012941306965735452076976674",
"length": 167
},
"id": "CVE-2026-85719-6f20b3c4",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/be439b2ec773d12d61914c238d3e8eeaa6f0ba21",
"target": {
"file": "client/src/test/java/org/asynchttpclient/proxy/ConnectTunnelStateTest.java",
"function": "stopTunnellingServers"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "331660497608270561293912967488858588564",
"length": 431
},
"id": "CVE-2026-85719-6f7819ee",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/be439b2ec773d12d61914c238d3e8eeaa6f0ba21",
"target": {
"file": "client/src/test/java/org/asynchttpclient/proxy/ConnectTunnelStateTest.java",
"function": "startTunnellingServers"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"238696526171461081928386196208895782124",
"332819521107744308326652498268769893525",
"146597571917301931980901776639768255101",
"66046010431470328157265737166734210656",
"17967064868072176859616783158349222418",
"307802084703857633542215844541858827282",
"13406889127457890779057794123057300182",
"184083788402296999311609254931970935703",
"169305531137513024913317615261901598883",
"321234721163965742211130054687331047689",
"297973502668755970031247137439747924851",
"174239293965893381148925794049087960414",
"14641377010953470510754909940621926493",
"281249801133379079732460697291528960789",
"338763655413997784328121408999555167662",
"227709019057709113378158831314702263614",
"124297600293090333557244178862177850078",
"190309589948792220170731949770607139524",
"298929280008337597575151204069029153755",
"7059065713978580129506669641069809060",
"202061603827578723640585373941084155513",
"46870856543729047467111649566581211055",
"60841802642920113111922120097573947755",
"268863357292404851798353457048941997670",
"151661632902626534704634111406789926481",
"259317149635394852003486237663536862360",
"293057168018567530891557362623219926753",
"9873091066978799828922724938218234983",
"72651732870887757344783569802465665975",
"162697825626074860039041021064346035102",
"329198258982528451841168592678232171696",
"144402493925301969712136849928225800059",
"265680787088328267830043051588781152304",
"250604136981496091772933920011523472200",
"111876959483390874312023667657720133682",
"206921469672551112020403970221342736765",
"263224448780487223577293680689327211645",
"183978423364187211823068264089363167663",
"87857939987666790456047838873080141716",
"116607959109965073239935058152383142086",
"40070376398185948389633386639891143441",
"286593911541365769635900192338112417261",
"248937567762131641280935234919285605474"
],
"threshold": 0.9
},
"id": "CVE-2026-85719-7bfdedd0",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/be439b2ec773d12d61914c238d3e8eeaa6f0ba21",
"target": {
"file": "client/src/test/java/org/asynchttpclient/proxy/ConnectTunnelStateTest.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "168235663213101377552889497251016889279",
"length": 491
},
"id": "CVE-2026-85719-9735b81c",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/abaa8bd260beda3b85825ff95069ed11eaf4ca8d",
"target": {
"file": "client/src/test/java/org/asynchttpclient/netty/handler/intercept/ProxyUnauthorized407InterceptorTest.java",
"function": "newFuture"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "96765924460902032792014908567981239529",
"length": 3411
},
"id": "CVE-2026-85719-998e065e",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/abaa8bd260beda3b85825ff95069ed11eaf4ca8d",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/handler/intercept/ProxyUnauthorized407Interceptor.java",
"function": "exitAfterHandling407"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "210846140950120433088470128417951298439",
"length": 1946
},
"id": "CVE-2026-85719-bf74bb99",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/718ed2e86126663a88ea3db7a88cbbf93f0069b5",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/request/NettyRequestSender.java",
"function": "sendRequestWithNewChannel"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"106928490227402425846485322208196537180",
"134087839100586852498804837535585429398",
"31232327604584187372853999301248900856"
],
"threshold": 0.9
},
"id": "CVE-2026-85719-c458efba",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/be439b2ec773d12d61914c238d3e8eeaa6f0ba21",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/handler/intercept/ProxyUnauthorized407Interceptor.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "319981061666573934872902157208912328509",
"length": 685
},
"id": "CVE-2026-85719-c7b286ac",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/d1f0ccec417092098d40242fee7dfac84bb3c21f",
"target": {
"file": "client/src/main/java/org/asynchttpclient/cookie/ThreadSafeCookieStore.java",
"function": "add"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"267090167665283298709257493523770502804",
"142994146173618394697574926892165475267",
"168237848084006279366130606289693211230",
"326963252261415096313270388005935082662"
],
"threshold": 0.9
},
"id": "CVE-2026-85719-e2b3fca1",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/718ed2e86126663a88ea3db7a88cbbf93f0069b5",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/request/NettyRequestFactory.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"225546867910362386147586302585209164117",
"328318519165691958541597245576800756849",
"30405163097755438081724424560570154259",
"207232645798444799893368426710766267015",
"179804716919320072808560764495481761395",
"138742024717210381973667802516164302853",
"130399774940650443211977333096698208093",
"58326288398156279468849196725674816654",
"183953291242655221716237922154855555814",
"114674422634256992639294696471933455974"
],
"threshold": 0.9
},
"id": "CVE-2026-85719-e6c66a40",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/abaa8bd260beda3b85825ff95069ed11eaf4ca8d",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/handler/intercept/ProxyUnauthorized407Interceptor.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"89457052815896678773937785732809939893",
"158058010902377367893555265954386365076",
"213381236813743651042942565750033124138",
"100083371363939628675199067023014843374"
],
"threshold": 0.9
},
"id": "CVE-2026-85719-e7cc32c3",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/4d887704dec22027310f66c81503226722e9bd23",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/request/NettyRequestSender.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"267090167665283298709257493523770502804",
"142994146173618394697574926892165475267",
"168237848084006279366130606289693211230",
"326963252261415096313270388005935082662"
],
"threshold": 0.9
},
"id": "CVE-2026-85719-fe7bf6c6",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/4d887704dec22027310f66c81503226722e9bd23",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/request/NettyRequestFactory.java"
}
}
]
vanir_signatures_modified
"2026-10-28T11:18:55Z"