CVE-2026-85721
- Source
- https://cve.org/CVERecord?id=CVE-2026-85721
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-85721.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-85721
- Aliases
- Downstream
CGA (16)
CLSA (1)
DEBIAN (1)
ECHO (1)
ROOT (1)
UBUNTU (1)
- Published
- 2026-09-17T15:55:32Z
- Modified
- 2026-10-28T11:18:57Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- AsyncHttpClient: Unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of service
- Details
-
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 and 3.0.12, automatic response decompression on the HTTP/1.1 path uses ChannelManager.newHttpContentDecompressor() to install Http1ContentDecompressor without a cumulative output-size limit. A hostile or compromised server, or an attacker who can alter a response in transit, can send a small gzip, deflate, or snappy response that expands across chunks until the client exhausts its heap and raises OutOfMemoryError; brotli and zstd are also affected when their optional codecs are present. In versions 3.0.8 through 3.0.10, the HTTP/2 decompressor is also unbounded, so switching protocols does not mitigate the issue on those releases. A limit applied to each decode call is insufficient because the response can be delivered as many small chunks, so the fixed implementation tracks total decompressed bytes for the whole response. This issue is fixed in versions 2.16.1 and 3.0.12.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-400", "CWE-409" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85721.json" }- References
-
- https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-7grg-jcf7-rpmx
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85721.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-85721
- https://github.com/AsyncHttpClient/async-http-client/commit/5ee2841cbf268bba4a200578be3938ccfc6cc6d6
- https://github.com/AsyncHttpClient/async-http-client/commit/663a1a91757904b22cfe37e2e6049f1f8ea6ae59
- https://github.com/AsyncHttpClient/async-http-client/commit/e1871a19972fb496be1b8ac6be11d79e22ff2162
- https://github.com/AsyncHttpClient/async-http-client/commit/e9f2f7423e0f6503f529656f2955a1317e56ba14
Affected packages
Git / github.com/asynchttpclient/async-http-client
Affected ranges
- Type
- GIT
- Repo
- https://github.com/asynchttpclient/async-http-client
- Events
-
IntroducedFixedIntroducedFixedFixedFixedFixedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "2.0.0" }, { "fixed": "2.16.1" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "introduced": "3.0.0" }, { "fixed": "3.0.12" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "fixed": "5ee2841cbf268bba4a200578be3938ccfc6cc6d6" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "663a1a91757904b22cfe37e2e6049f1f8ea6ae59" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "e1871a19972fb496be1b8ac6be11d79e22ff2162" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "e9f2f7423e0f6503f529656f2955a1317e56ba14" } ], "source": "REFERENCES_COMMIT" } ] }
Affected versions
async-http-client-project-2.*
async-http-client-project-2.0.0
async-http-client-project-2.0.1
async-http-client-project-2.0.10
async-http-client-project-2.0.11
async-http-client-project-2.0.12
async-http-client-project-2.0.13
async-http-client-project-2.0.14
async-http-client-project-2.0.15
async-http-client-project-2.0.16
async-http-client-project-2.0.17
async-http-client-project-2.0.18
async-http-client-project-2.0.19
async-http-client-project-2.0.2
async-http-client-project-2.0.20
async-http-client-project-2.0.21
async-http-client-project-2.0.22
async-http-client-project-2.0.23
async-http-client-project-2.0.24
async-http-client-project-2.0.3
async-http-client-project-2.0.4
async-http-client-project-2.0.5
async-http-client-project-2.0.6
async-http-client-project-2.0.7
async-http-client-project-2.0.8
async-http-client-project-2.0.9
async-http-client-project-2.1.0
async-http-client-project-2.1.0-RC1
async-http-client-project-2.1.0-RC2
async-http-client-project-2.1.0-RC3
async-http-client-project-2.1.0-RC4
async-http-client-project-2.1.0-alpha10
async-http-client-project-2.1.0-alpha11
async-http-client-project-2.1.0-alpha12
async-http-client-project-2.1.0-alpha13
async-http-client-project-2.1.0-alpha14
async-http-client-project-2.1.0-alpha15
async-http-client-project-2.1.0-alpha16
async-http-client-project-2.1.0-alpha17
async-http-client-project-2.1.0-alpha18
async-http-client-project-2.1.0-alpha19
async-http-client-project-2.1.0-alpha2
async-http-client-project-2.1.0-alpha20
async-http-client-project-2.1.0-alpha21
async-http-client-project-2.1.0-alpha22
async-http-client-project-2.1.0-alpha23
async-http-client-project-2.1.0-alpha24
async-http-client-project-2.1.0-alpha25
async-http-client-project-2.1.0-alpha26
async-http-client-project-2.1.0-alpha3
async-http-client-project-2.1.0-alpha4
async-http-client-project-2.1.0-alpha5
async-http-client-project-2.1.0-alpha6
async-http-client-project-2.1.0-alpha7
async-http-client-project-2.1.0-alpha8
async-http-client-project-2.1.0-alpha9
async-http-client-project-2.1.1
async-http-client-project-2.1.2
async-http-client-project-2.10.0
async-http-client-project-2.10.1
async-http-client-project-2.10.2
async-http-client-project-2.10.3
async-http-client-project-2.10.4
async-http-client-project-2.10.5
async-http-client-project-2.11.0
async-http-client-project-2.12.0
async-http-client-project-2.12.1
async-http-client-project-2.12.2
async-http-client-project-2.12.3
async-http-client-project-2.12.4
async-http-client-project-2.14.5
async-http-client-project-2.15.0
async-http-client-project-2.16.0
async-http-client-project-2.2.0
async-http-client-project-2.2.1
async-http-client-project-2.3.0
async-http-client-project-2.4.0
async-http-client-project-2.4.1
async-http-client-project-2.4.2
async-http-client-project-2.4.3
async-http-client-project-2.4.4
async-http-client-project-2.4.5
async-http-client-project-2.4.6
async-http-client-project-2.4.7
async-http-client-project-2.4.8
async-http-client-project-2.4.9
async-http-client-project-2.5.0
async-http-client-project-2.5.1
async-http-client-project-2.5.2
async-http-client-project-2.5.3
async-http-client-project-2.5.4
async-http-client-project-2.6.0
async-http-client-project-2.7.0
async-http-client-project-2.8.0
async-http-client-project-2.8.1
async-http-client-project-2.9.0
async-http-client-project-3.*
async-http-client-project-3.0.0
async-http-client-project-3.0.1
async-http-client-project-3.0.10
async-http-client-project-3.0.11
async-http-client-project-3.0.2
async-http-client-project-3.0.3
async-http-client-project-3.0.4
async-http-client-project-3.0.5
async-http-client-project-3.0.6
async-http-client-project-3.0.7
async-http-client-project-3.0.8
async-http-client-project-3.0.9
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-85721.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"line_hashes": [
"232422142319006281861898132950466855493",
"291182238246315395024913239899957798354",
"288868789285424695219639539870084577033",
"229654217952396670446854031704650347926",
"243554837533636626408594585351317523093",
"166974742836379092408294567883205183105",
"246700512460015785166790922409667472275",
"9474789531061464836115069774168950049",
"114978808632960159680669896887010600950",
"192956759423170029774424726096955950642",
"275470787664514275804296989215813268018",
"71736429236115293848864905265595642078",
"116302443784445728337781558636799774375",
"92329052072624315664356374459722033136",
"45774521145341530249425373324286037148",
"50423428259083336598866931060831523389",
"135296582066814052683316460406522057014",
"317143473065698183403502977475792579045",
"243840202739250060083392539286958967833",
"12581070138712967989199471120179725168",
"220761558912526408882631931544425656922",
"80724934451353831629802371460918006635",
"62953493865548444449415960970812918961",
"164402593386894774980977907709718732216",
"121663911071030037552230399267083643875",
"293114238661033552817531492787500867120",
"104533322216992229224520763340330653739",
"271309400229047126188769088140300242082",
"207286351235283570454848707712596112480",
"304847084159706375192668569919943869695",
"309503630041263084228001610818247298931",
"163189763352454410448597292807607650867",
"164763422449015231949302705396905542032",
"192516762129791855307380175299912700233"
],
"threshold": 0.9
},
"id": "CVE-2026-85721-02fc67b5",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/663a1a91757904b22cfe37e2e6049f1f8ea6ae59",
"target": {
"file": "client/src/main/java/org/asynchttpclient/DefaultAsyncHttpClientConfig.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "268636168610361961677550457155044984919",
"length": 154
},
"id": "CVE-2026-85721-082f32f4",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/663a1a91757904b22cfe37e2e6049f1f8ea6ae59",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/channel/ChannelManager.java",
"function": "maxDecompressedResponseSize"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"136605292789126586137897476190240709178",
"93286752024425783472212860161354910843",
"157058216304255826548244000533468180221",
"247035483005035176656274008711644674128",
"181031010953822110429672478834038310649",
"197537465510868724123599756385495730848",
"194429174884627287388260231921128741151"
],
"threshold": 0.9
},
"id": "CVE-2026-85721-0ad72d57",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/e9f2f7423e0f6503f529656f2955a1317e56ba14",
"target": {
"file": "client/src/main/java/org/asynchttpclient/config/AsyncHttpClientConfigDefaults.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "15514737135908799225400833295311057131",
"length": 317
},
"id": "CVE-2026-85721-1031070e",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/5ee2841cbf268bba4a200578be3938ccfc6cc6d6",
"target": {
"file": "client/src/test/java/org/asynchttpclient/Http1DecompressionLimitTest.java",
"function": "decompressionWithinLimitSucceeds"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "133291250190718625009593919251532975254",
"length": 335
},
"id": "CVE-2026-85721-12c764a4",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/5ee2841cbf268bba4a200578be3938ccfc6cc6d6",
"target": {
"file": "client/src/test/java/org/asynchttpclient/Http1DecompressionLimitTest.java",
"function": "handle"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"283775597229596223240799526855943186543",
"217019527134726766391178497774962918341",
"176651195896002427299839952020600163938",
"102521776700634585217367237032634956352",
"134124788229932739577095654977250134080",
"58195213756392773288634065061167870782",
"171141356910919839814209311105805430902",
"138402950590930048703508215119402572409",
"275565402892099963292144080518107511194",
"303761397507753816672114668951221945363",
"115242088338668525021165977781134910851",
"124674842063892745004246330708524291229",
"216432414809729648036478066767079756671",
"153106162557719377591134321442493208598",
"113753920892116404260938961270849540883",
"61383800767276443176281617214512799154",
"290179997617014184037238051567056721996",
"282465379346292993375627082649423753873",
"256306600769836907542268459857496628641",
"262819383980843163152020453356408776084",
"189637117046272573512585667143409253843",
"142497657907533064446419730342814650260",
"81045361121541237549141568874568146301",
"265002258205281416548226005190862871419",
"295469077650336460906469074716956252087",
"331752071902727230674058359093314174946"
],
"threshold": 0.9
},
"id": "CVE-2026-85721-1d96a9f8",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/5ee2841cbf268bba4a200578be3938ccfc6cc6d6",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/channel/ChannelManager.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"219246596221720898981563676126452787927",
"112413554918931264338179563940130289539",
"262908889413526511266896616639455764237"
],
"threshold": 0.9
},
"id": "CVE-2026-85721-26220b3f",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/d1f0ccec417092098d40242fee7dfac84bb3c21f",
"target": {
"file": "client/src/main/java/org/asynchttpclient/cookie/ThreadSafeCookieStore.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "142365070590460775638689491472206130089",
"length": 317
},
"id": "CVE-2026-85721-3ef7281d",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/663a1a91757904b22cfe37e2e6049f1f8ea6ae59",
"target": {
"file": "client/src/test/java/org/asynchttpclient/Http1DecompressionLimitTest.java",
"function": "decompressionWithinLimitSucceeds"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "275288044650255140003835811553756618455",
"length": 110
},
"id": "CVE-2026-85721-43fa7665",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/663a1a91757904b22cfe37e2e6049f1f8ea6ae59",
"target": {
"file": "client/src/test/java/org/asynchttpclient/Http1DecompressionLimitTest.java",
"function": "url"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "247812204483236988560659050437122045705",
"length": 49
},
"id": "CVE-2026-85721-49e3a3c0",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/663a1a91757904b22cfe37e2e6049f1f8ea6ae59",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/channel/ChannelManager.java",
"function": "getTargetContentEncoding"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "286797549388792261987362569944565651182",
"length": 302
},
"id": "CVE-2026-85721-4cca1b2b",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/5ee2841cbf268bba4a200578be3938ccfc6cc6d6",
"target": {
"file": "client/src/test/java/org/asynchttpclient/Http1DecompressionLimitTest.java",
"function": "zeroDisablesTheLimit"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "211524354630519167115886635587259083862",
"length": 1952
},
"id": "CVE-2026-85721-4fba70db",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/e9f2f7423e0f6503f529656f2955a1317e56ba14",
"target": {
"file": "client/src/main/java/org/asynchttpclient/DefaultAsyncHttpClientConfig.java",
"function": "build"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "102210437033183436716605626586636489619",
"length": 2913
},
"id": "CVE-2026-85721-60fa06c7",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/e9f2f7423e0f6503f529656f2955a1317e56ba14",
"target": {
"file": "client/src/main/java/org/asynchttpclient/DefaultAsyncHttpClientConfig.java",
"function": "Builder"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "247812204483236988560659050437122045705",
"length": 49
},
"id": "CVE-2026-85721-630ed74c",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/5ee2841cbf268bba4a200578be3938ccfc6cc6d6",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/channel/ChannelManager.java",
"function": "getTargetContentEncoding"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "294963771982796116016272728443574764473",
"length": 2316
},
"id": "CVE-2026-85721-666c6ba9",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/663a1a91757904b22cfe37e2e6049f1f8ea6ae59",
"target": {
"file": "client/src/main/java/org/asynchttpclient/DefaultAsyncHttpClientConfig.java",
"function": "build"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "240027540437748791969004750519753030604",
"length": 223
},
"id": "CVE-2026-85721-6f5f6d97",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/e1871a19972fb496be1b8ac6be11d79e22ff2162",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/channel/ChannelManager.java",
"function": "newHttpContentDecompressor"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "137409153702737422671720379622085289958",
"length": 109
},
"id": "CVE-2026-85721-760f2d2a",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/5ee2841cbf268bba4a200578be3938ccfc6cc6d6",
"target": {
"file": "client/src/test/java/org/asynchttpclient/Http1DecompressionLimitTest.java",
"function": "url"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"56628426810235063573881601835518705212",
"98863602492797482051001955152575232651",
"168708030931315284119633378746194519897",
"323118739161249961575902385977636436584",
"334992991296175242111354035823469142353",
"271822672823942604839887274613334307985",
"244581545066525023760585299063913038831",
"65940087485906687092552978963333988091",
"317380811479487848309747621836150969957",
"98042534146039712122852963027239621006",
"91985928600011047021334984488606393240",
"219226163704451806058899246480763541896",
"329077695449393596327340357453967312635",
"103130826254616254744882727756545218051",
"270755590794414394480062281332741855798",
"158225415363106774685278552153992761161",
"274716218311032562488573274526499001432",
"285778583368544597458712193506663691195",
"251353582450717508043398503140225840782",
"60128167153638382511900716462652111248",
"121965780145498803782730280504628271319",
"70613965375182917763275165399713622446",
"112885456157933089892758629853459307451",
"238383509518086117553056835513579899022",
"260585972207083072107899496621256112506",
"256923009251297248325311504439020905432",
"44646086331062534548363378097231592436",
"243194092153388997443129777639977022562",
"93744454045808144526518444161344146135",
"318456848463446132071917192924865087418"
],
"threshold": 0.9
},
"id": "CVE-2026-85721-775c8bda",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/e9f2f7423e0f6503f529656f2955a1317e56ba14",
"target": {
"file": "client/src/main/java/org/asynchttpclient/DefaultAsyncHttpClientConfig.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"275565402892099963292144080518107511194",
"286919822855869767086560029511100999407",
"295522092438859482711662012455452106806",
"219238406395076026021067641603888555400",
"171189877201170129987209243860659962960",
"166348701500857109927850156792720413416",
"61383800767276443176281617214512799154",
"290179997617014184037238051567056721996",
"38373440955360048143194709477200503272",
"321933079930893239218915695937167291389",
"329134046041209801733353675503030547394",
"264605668288727480065929111701079847641",
"145373809970281649993254447403004549941",
"227790086761575860747468602514736401018",
"228704567090067799305778481591504979710"
],
"threshold": 0.9
},
"id": "CVE-2026-85721-790664c8",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/e1871a19972fb496be1b8ac6be11d79e22ff2162",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/channel/ChannelManager.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"140884276213124497354819724513146846717",
"201440705702005614784374764867624632464",
"276341561662367420677373975754451998838"
],
"threshold": 0.9
},
"id": "CVE-2026-85721-7f3c6b07",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/e9f2f7423e0f6503f529656f2955a1317e56ba14",
"target": {
"file": "client/src/test/java/org/asynchttpclient/AsyncHttpClientDefaultsTest.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "192669505897136047477787096819824863592",
"length": 365
},
"id": "CVE-2026-85721-7f5cb704",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/663a1a91757904b22cfe37e2e6049f1f8ea6ae59",
"target": {
"file": "client/src/test/java/org/asynchttpclient/Http1DecompressionLimitTest.java",
"function": "decompressionBeyondLimitFails"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "44881690253830619628116260721407144181",
"length": 443
},
"id": "CVE-2026-85721-817ae7b7",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/5ee2841cbf268bba4a200578be3938ccfc6cc6d6",
"target": {
"file": "client/src/test/java/org/asynchttpclient/Http1DecompressionLimitTest.java",
"function": "decompressionBeyondLimitFails"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"94861521542398076028415856238342951656",
"217019527134726766391178497774962918341",
"176651195896002427299839952020600163938",
"102521776700634585217367237032634956352",
"134124788229932739577095654977250134080",
"113101114715184525599659647059621638498",
"124361309962013554329616608031323629522",
"333888186655316678887059206850226422830",
"275565402892099963292144080518107511194",
"303761397507753816672114668951221945363",
"178430553461075238101863282128378259932",
"14831770139244395290502651775109878673",
"34356040705157856944706721430123440833",
"197471363703389004133315426714169206119",
"113753920892116404260938961270849540883",
"61383800767276443176281617214512799154",
"290179997617014184037238051567056721996",
"38373440955360048143194709477200503272",
"284634762025666059818678307719557359352",
"328758334390510320565472506954499458183",
"137648685536181285780326066359680289276",
"127411585181470834190360981738489933553",
"150289646141858458636160333222812289582",
"181938548784488326382537512354315587264",
"202509027172681985117186951059031752967",
"134884911170830056884170303235746857293",
"251948480005204906412257209857184746764",
"136692276717126613228604397072611638766",
"164812528154732689166535991540641103047",
"121183406060687555283031500602853583698"
],
"threshold": 0.9
},
"id": "CVE-2026-85721-8895586d",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/663a1a91757904b22cfe37e2e6049f1f8ea6ae59",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/channel/ChannelManager.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "288011389604904485836306684362513628725",
"length": 250
},
"id": "CVE-2026-85721-8be276b3",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/5ee2841cbf268bba4a200578be3938ccfc6cc6d6",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/channel/ChannelManager.java",
"function": "newHttpContentDecompressor"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"212117052689699095376245710363635169518",
"279142475710330639559024811667957534349",
"253664014419481455645171731867057315819",
"83572639396317688267460124176914313142",
"10277875704760260856591603924710245019",
"81598117634355374444311620032849895174",
"267739236147566551993255559734167577930",
"278272275273309688133871942519280186084",
"234768642665979410905677364558802647896",
"25986036395542714686212089933092605801",
"339224800023704388371972343110756989068",
"250617740917111971177519089023637627457",
"171108709465057306128481045973570861502",
"131533947927997151099896795791487309325",
"7540735884981143083240544596275854157",
"254301676040282853863667898371409677799",
"275963587258437083167363249915144738908",
"226133004131681402258868173902813130374",
"10696927886652476857128429746850353706",
"13219055311095865432107090729467449298",
"58660627908202119881061829279268385573",
"40907718928941697574188528987953279832",
"53738364976912239233622895069585329093",
"142625730429662794863920972218007461741",
"200548454417859509111376238625642983182",
"219657705260252728952986986826931338406",
"232772451168463369591638141047986638386",
"182943970395731077189698600262622493024",
"217236791455753438888652213360010044566",
"42403224453361757285580493562683225630",
"66194455618031519864823764086835425221",
"72446428779104540805925072961449682023",
"154353862163579035352660301163038698025",
"220078333289445403573801937055563496766",
"319901965441024798125892509910761203611",
"96249457422849036390526710479326929959",
"173380370508778885529750663993659443899",
"219402280012699422840805506519477608345",
"167279059180361705164545723165804371308",
"165792693071714298321742600169573578037",
"129885868688861819482755795800363767420",
"26070719117992100308808008748575384459",
"74131729899340830481920872688002600114",
"123909586907058493445565356778542019969",
"53341775042506242837324699866235282892",
"237679277231598152051632247447928055301",
"150461251193945653057043579254635469314",
"89144554632797485336006888647903148717",
"169910155607582884393484292398907209413",
"59663628981165551407687817912697697845",
"329249793150623055086857495438226642074",
"291518133116314218970697457228203508121",
"102773042227712380051185624212894701760",
"193945555105656936453847297800470789796",
"271816958444307605243581695249172958204",
"183863113287850490688877482757206605163",
"30562622058900394925338756278339254102",
"123702665535302162473068238000443173407",
"5615342745186305052473016440103583026",
"142969077741078595147948043242106032317",
"149583274880297256440862596697054192799",
"212444236658232935148043107522085855304",
"53661707379719486442836436727634936615",
"95849785370474923635099038310705285261",
"114336921601051962963259376265699558827",
"92835847137710336446533702305247450180",
"248593814975866783639016412981594826415",
"217848700432897186601913877365600050772",
"271946768282436747413242391430796498051",
"22165181534341279538263808944096792220",
"79784354286937844025026491555325286621",
"195305948266639542488092147065696976852"
],
"threshold": 0.9
},
"id": "CVE-2026-85721-8d3f5f4e",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/663a1a91757904b22cfe37e2e6049f1f8ea6ae59",
"target": {
"file": "client/src/test/java/org/asynchttpclient/Http1DecompressionLimitTest.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "151530310303361515922725363708011387029",
"length": 4009
},
"id": "CVE-2026-85721-9cb131a1",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/663a1a91757904b22cfe37e2e6049f1f8ea6ae59",
"target": {
"file": "client/src/main/java/org/asynchttpclient/DefaultAsyncHttpClientConfig.java",
"function": "Builder"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"75112049838550294865095413135666946838",
"38121397461435969632613365536792606670",
"4424431510471493052134323604447047999",
"299320986034132284785840816891252240416",
"217515332032684565436895812716799882326",
"13205883352730951972056562449729851616",
"102921076857374730015262117304549032445"
],
"threshold": 0.9
},
"id": "CVE-2026-85721-9d03e223",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/663a1a91757904b22cfe37e2e6049f1f8ea6ae59",
"target": {
"file": "client/src/main/java/org/asynchttpclient/config/AsyncHttpClientConfigDefaults.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "98788785154816827735320178561981473322",
"length": 299
},
"id": "CVE-2026-85721-a192038c",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/663a1a91757904b22cfe37e2e6049f1f8ea6ae59",
"target": {
"file": "client/src/test/java/org/asynchttpclient/Http1DecompressionLimitTest.java",
"function": "handle"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "119345450316302433959338717177712650938",
"length": 258
},
"id": "CVE-2026-85721-a300e3be",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/663a1a91757904b22cfe37e2e6049f1f8ea6ae59",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/channel/ChannelManager.java",
"function": "newHttpContentDecompressor"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"275565402892099963292144080518107511194",
"35610983296169483294874178166639193574",
"175673857706647640107355273126599386370",
"11063358392641269024322188487491868012",
"315383224209888561826577568961049935200",
"166348701500857109927850156792720413416",
"61383800767276443176281617214512799154",
"290179997617014184037238051567056721996",
"282465379346292993375627082649423753873",
"183704646713377588213416196606154439092",
"180941362944107530913465587685130991052",
"310340278198983284547818033402920004923",
"184144591356793207518103395537479344910"
],
"threshold": 0.9
},
"id": "CVE-2026-85721-abbb6861",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/e9f2f7423e0f6503f529656f2955a1317e56ba14",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/channel/ChannelManager.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"192586203308578742910123705485563400497",
"31754748900209837347466441280997768303",
"338073263965877897064919477097225823577"
],
"threshold": 0.9
},
"id": "CVE-2026-85721-b70d7e43",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/e9f2f7423e0f6503f529656f2955a1317e56ba14",
"target": {
"file": "extras/typesafeconfig/src/main/java/org/asynchttpclient/extras/typesafeconfig/AsyncHttpClientTypesafeConfig.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "216239744091746136825840504282296760579",
"length": 85
},
"id": "CVE-2026-85721-c6c6dcd1",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/5ee2841cbf268bba4a200578be3938ccfc6cc6d6",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/channel/ChannelManager.java",
"function": "maxDecompressedResponseSize"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "261717858941900812825332942664535215563",
"length": 215
},
"id": "CVE-2026-85721-c79e71ee",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/e9f2f7423e0f6503f529656f2955a1317e56ba14",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/channel/ChannelManager.java",
"function": "newHttpContentDecompressor"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "319981061666573934872902157208912328509",
"length": 685
},
"id": "CVE-2026-85721-c7b286ac",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/d1f0ccec417092098d40242fee7dfac84bb3c21f",
"target": {
"file": "client/src/main/java/org/asynchttpclient/cookie/ThreadSafeCookieStore.java",
"function": "add"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "127043616423539821467418464586208125887",
"length": 201
},
"id": "CVE-2026-85721-cee4a32d",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/663a1a91757904b22cfe37e2e6049f1f8ea6ae59",
"target": {
"file": "client/src/test/java/org/asynchttpclient/Http1DecompressionLimitTest.java",
"function": "clientWithLimit"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "224948673634706379198847040819298125970",
"length": 580
},
"id": "CVE-2026-85721-cf40235d",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/663a1a91757904b22cfe37e2e6049f1f8ea6ae59",
"target": {
"file": "client/src/test/java/org/asynchttpclient/Http1DecompressionLimitTest.java",
"function": "setupServer"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "284405836000190709832571230196630985497",
"length": 3790
},
"id": "CVE-2026-85721-d0f97b3e",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/663a1a91757904b22cfe37e2e6049f1f8ea6ae59",
"target": {
"file": "client/src/main/java/org/asynchttpclient/DefaultAsyncHttpClientConfig.java",
"function": "DefaultAsyncHttpClientConfig"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"217052812546843148433997531705433723718",
"111864495540955524582492717496724366107",
"319055962622551599618367161227080682258"
],
"threshold": 0.9
},
"id": "CVE-2026-85721-d3545437",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/663a1a91757904b22cfe37e2e6049f1f8ea6ae59",
"target": {
"file": "client/src/main/java/org/asynchttpclient/AsyncHttpClientConfig.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "156103416248155711612022552723599821341",
"length": 2715
},
"id": "CVE-2026-85721-d3e031cb",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/e9f2f7423e0f6503f529656f2955a1317e56ba14",
"target": {
"file": "client/src/main/java/org/asynchttpclient/DefaultAsyncHttpClientConfig.java",
"function": "DefaultAsyncHttpClientConfig"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "27143398323460393012727588710989156054",
"length": 447
},
"id": "CVE-2026-85721-e1a8e2e8",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/5ee2841cbf268bba4a200578be3938ccfc6cc6d6",
"target": {
"file": "client/src/test/java/org/asynchttpclient/Http1DecompressionLimitTest.java",
"function": "decompressionBeyondLimitFailsWithKeepEncodingHeader"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"164273182428589152258371102587223258924",
"292049732825305197262761368421809972351",
"287017730970488723661062065873413129486",
"277903112373406948476434722805533078969",
"311636171919200828834556838018577749176",
"268786700975725003085263503825141551892",
"194082269956513071317658046991359434124",
"258733640781421138061083084389023431962"
],
"threshold": 0.9
},
"id": "CVE-2026-85721-e39b4781",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/5ee2841cbf268bba4a200578be3938ccfc6cc6d6",
"target": {
"file": "client/src/main/java/org/asynchttpclient/AsyncHttpClientConfig.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"40800626812469606821667367368461879303",
"338027205104459988223760925037593414316",
"22200648183820010548393007313071160008",
"233847434771113942044237522038401443332",
"164273182428589152258371102587223258924",
"292049732825305197262761368421809972351",
"287017730970488723661062065873413129486",
"265281855647680269905411265116138282316",
"194092427084211588973149086854612043710",
"103063788916094567685560045036102805188"
],
"threshold": 0.9
},
"id": "CVE-2026-85721-ee85a6c5",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/e9f2f7423e0f6503f529656f2955a1317e56ba14",
"target": {
"file": "client/src/main/java/org/asynchttpclient/AsyncHttpClientConfig.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"279142475710330639559024811667957534349",
"313707442672686745902337892466788850668",
"23937465237565736611341477448005525014",
"328212302231296429684029304340272969668",
"239245597716515133833672116814009637587",
"5230563309293158746862519804476634769",
"296666971384115110424100076037734089094",
"329825100658237104948468788181489389363",
"36352197818230410323618537981020742356",
"179601999888150361780500585003172791581",
"290131320046703690970731361110671660647",
"71173294871040843705744103073918543466",
"183141263484247229526620917152295514569",
"42589183136496540372904370598849682605",
"323874146316539094553331444028844089273",
"268119990777726725152463812874757409509",
"98552329954397515101385673797125557058",
"83348918569718538677312960240353122076",
"194036180338649124398239149014365476158",
"116500532630141385368919310489466107495",
"172818315410449006226048655514352295514",
"135670215317462137334671585229726483937",
"292643657632352140910028246853325886205",
"190238767384377940376159309475508997516",
"677512780866525150782630206729387937",
"27009676365129186802173466081733213685",
"323500839087724504143103051517635405424",
"328849041735206778660349596797523759794",
"320140804529567588528858468256163569145",
"4330997005475899606327958833263572472",
"321495503299683474484247317255944836071",
"314511422078938383138574188628581103506",
"284963276117193901889574422006192851499",
"287711691329569424916370545455548914804",
"139728551628221402160091719075720637044",
"36502284627178570660855129161375090417",
"123909586907058493445565356778542019969",
"4329166281635432733927083957944862847",
"272662168520128219678911449873849530686",
"122541759124395396605556883335721241991",
"43320903443225306239162032197274375827",
"271816958444307605243581695249172958204",
"268240726142169873618860705453508678263",
"9737888511233138101205767198385899469",
"52585616313258431081268521008619771516",
"117252227646592292761740957162540430669",
"9790449757009531382459005270886121826",
"291907324525333693805457906060948729311",
"71713225355766179750741533190854158172",
"13151554083764158525946926061539604579",
"79124364020567065116949827881832772656",
"53661707379719486442836436727634936615",
"5782456872245985370789775366272662915",
"278363375939806248864455560317664556487",
"61617388120507580626436215521375418939",
"313761386599960951551592699412226766169",
"120932377839005560101411804158565772056",
"20898593115268503497416492931968485312",
"154408279115765390378212599008813587685",
"102656583640707469966988730023436752633",
"191006861279042708836136910048797514459",
"128510283316878537000390829339935256789",
"318770853446358593141046262157178983711",
"163573207565121688309013047694308771370",
"174242092200905594953398154526820339718",
"151338212262951629112069218612506380109",
"272821150043193099161283678170198562234",
"79124364020567065116949827881832772656",
"53661707379719486442836436727634936615",
"5782456872245985370789775366272662915",
"24501234535006697431234705038672472381",
"74383734730149515891129715993678338443",
"301161779593328279160893470712172452429",
"319493220394717623569943871634451396953",
"92014857742499152552705274756762425332",
"33199043735076383196135712881409982058",
"120932377839005560101411804158565772056",
"20898593115268503497416492931968485312",
"148466264473233274741231144002644336380"
],
"threshold": 0.9
},
"id": "CVE-2026-85721-f662a3a8",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/5ee2841cbf268bba4a200578be3938ccfc6cc6d6",
"target": {
"file": "client/src/test/java/org/asynchttpclient/Http1DecompressionLimitTest.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "258706846629715741077711750754145006023",
"length": 638
},
"id": "CVE-2026-85721-f6817504",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/asynchttpclient/async-http-client/commit/5ee2841cbf268bba4a200578be3938ccfc6cc6d6",
"target": {
"file": "client/src/test/java/org/asynchttpclient/Http1DecompressionLimitTest.java",
"function": "setupServer"
}
}
]
vanir_signatures_modified
"2026-10-28T11:18:57Z"