CVE-2026-107232 AsyncHttpClient CVE debrief

Who should care

Defenders and security teams responsible for Java applications using the AsyncHttpClient library should assess their exposure and prioritize remediation. This includes reviewing application dependencies, identifying vulnerable versions, and upgrading to fixed versions. Additionally, they should ensure that proxy configurations are secure and that credentials are properly protected during transmission.

Why it matters

The vulnerability in AsyncHttpClient could lead to exposure of origin credentials, potentially allowing unauthorized access or lateral movement within networks. Defenders should prioritize verifying and remediating this vulnerability to protect against potential credential exposure and misuse.

• Potential exposure of origin credentials to proxies that reject CONNECT requests
• Possible recovery of basic credentials directly from cleartext transmissions
• Potential cracking or relaying of NTLM responses
• Need for verification of proxy configurations and credential security

Technical summary

The AsyncHttpClient library, used for HTTP requests in Java applications, had a vulnerability where it could send origin credentials in cleartext to a proxy that rejects the CONNECT request. This occurred because the client inferred the existence of an HTTP proxy tunnel from the last request method rather than the CONNECT result. After a proxy rejects CONNECT, redirect or authentication handlers could write an origin request and its Authorization credentials onto the still-plaintext proxy connection. Basic credentials could be directly recovered, while NTLM responses might be cracked or relayed. The issue is fixed in versions 3.0.12 and 2.16.1.

Defensive priority

Defenders should prioritize verifying if their applications use vulnerable versions of AsyncHttpClient and upgrading to fixed versions (3.0.12 or 2.16.1) as soon as possible. They should also review their proxy configurations and ensure that any credentials or sensitive data are properly secured during transmission.

Recommended defensive actions

• Verify if applications use vulnerable versions of AsyncHttpClient
• Upgrade to fixed versions (3.0.12 or 2.16.1) as soon as possible
• Review proxy configurations to ensure proper security of credentials and sensitive data
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details about the vulnerability in AsyncHttpClient. The issue arises from the client's handling of HTTP proxy tunnels and CONNECT requests, leading to potential exposure of origin credentials. The fixes are available in versions 3.0.12 and 2.16.1.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.