AsyncHttpClient · product
Async-Http-Client
28 CVEs
Every dot is a CVE in what this vendor ships; the named ones are the most at risk.
Every one of the 28 is a mark on the map. Named now: 1 to 26, most at risk first.
- Async Http Client (aka async-http-client) before 2.0.35 can be tricked into connecting to a host different from the one extracted by java.net.URI if a '?' character occurs in a fr…
- Async Http Client (aka AHC or async-http-client) before 1.9.0 skips X.509 certificate verification unless both a keyStore location and a trustStore location are explicitly set, wh…
- main/java/com/ning/http/client/AsyncHttpClientConfig.java in Async Http Client (aka AHC or async-http-client) before 1.9.0 does not require a hostname match during verification of…
- AsyncHttpClient (AHC) library's `CookieStore` replaces explicitly defined `Cookie`s
- AsyncHttpClient: Unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of service
- AsyncHttpClient: Connection permit leak on TLS handshake failure causes per-host denial of service
- AsyncHttpClient: Client-wide realm credentials re-sent to a cross-origin redirect target
- AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabled
- AsyncHttpClient leaks authorization credentials to untrusted domains on cross-origin redirects
- AsyncHttpClient: SCRAM and Digest mutual-authentication responses are not verified
- async-http-client: Cookie header not stripped on cross-origin redirect
- AsyncHttpClient: SOCKS proxy credentials sent to the origin server over plaintext HTTP
- AsyncHttpClient: Digest mutual authentication is switched off by a peer offering qop=auth-int
- AsyncHttpClient: Cookie stored for an unrelated domain (cookie tossing) via ThreadSafeCookieStore
- AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader (Bypass of CVE-2024-53990 Fix)
- AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPS
- AsyncHttpClient: Origin credentials sent to the proxy on the plaintext CONNECT request
- AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random source
- AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.uk
- AsyncHttpClient: Incomplete origin checks in the default cookie store allow cookie tossing onto public-suffix and IP-address hosts
- AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext
- AsyncHttpClient: Origin credentials sent in cleartext to a proxy that rejects the CONNECT
- AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel
- AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host
- AsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy logins
- AsyncHttpClient: Connection pool key omits the authenticated principal, so an NTLM or Negotiate connection is reused across identities
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-15 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.