CVE-2026-107279: asynchttpclient async-http-client

Vulnerability summary

CVE-2026-107279 is a high (CVSS 8.8) vulnerability in asynchttpclient async-http-client. EPSS estimates a 0.36% chance of exploitation in the next 30 days, higher than 28.1% of scored vulnerabilities.

Timeline

1. 07-10-2026
   PublishedVulnerability first disclosed.
2. 08-10-2026
   Last modifiedVulnerability information updated.

Description

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. In 3.0.12, a peer offering only Digest qop=auth-int causes mutual-authentication verification to be skipped. AuthenticatorUtils.computeExpectedRspAuth returns no expected value for auth-int, and Interceptors treats that result as unverifiable but nonfatal, so a response with an invalid rspauth value is accepted. A peer that does not know the shared secret can therefore be accepted as the authenticated server. This issue is fixed in version 3.0.13.

• CWE-303Incorrect Implementation of Authentication AlgorithmThe requirements for the product dictate the use of an established authentication algorithm, but the implementation of the algorithm is incorrect.
• CWE-757Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')A protocol or its implementation supports interaction between multiple actors and allows those actors to negotiate which algorithm should be used as a protection mechanism such as encryption or authentication, but it does not select the strongest algorithm that is available to both parties.