CVE-2026-85716 AsyncHttpClient CVE debrief

Who should care

Defenders and developers using AsyncHttpClient versions 3.0.8 through 3.0.11 in their Java applications should assess their exposure and consider upgrading to version 3.0.12 or later to mitigate the authentication bypass vulnerability.

Why it matters

CVE-2026-85716 is a vulnerability in the AsyncHttpClient library for Java that could allow for authentication bypass on non-TLS or compromised transports. Defenders and developers using affected versions should assess their exposure, consider upgrading, and monitor for suspicious activity.

• Potential authentication bypass on non-TLS or compromised transports.
• Verification of server response authenticity may be required.
• Upgrading to version 3.0.12 or later may be necessary to fully address the issue.
• Monitoring for unauthorized access or suspicious activity is recommended.

Technical summary

The AsyncHttpClient library for Java, in versions 3.0.8 through 3.0.12, incorrectly handles SCRAM ServerSignature or Digest rspauth verification, potentially allowing a peer without knowledge of the shared secret to be accepted as the server on non-TLS or compromised transports. This issue is particularly concerning as it could lead to authentication bypass. Defenders and developers using affected versions should assess their exposure and consider upgrading to version 3.0.12 or later to mitigate the authentication bypass vulnerability. Verification of server response authenticity may be required, especially in environments using AsyncHttpClient versions 3.0.8 through 3.0.11.

Defensive priority

Defenders should prioritize verifying the authenticity of server responses, especially in environments using AsyncHttpClient versions 3.0.8 through 3.0.11, and consider upgrading to version 3.0.12 or later.

Recommended defensive actions

• Verify the authenticity of server responses in AsyncHttpClient versions 3.0.8 through 3.0.11.
• Consider upgrading to AsyncHttpClient version 3.0.12 or later.
• Monitor for any unauthorized access or suspicious activity in applications using affected AsyncHttpClient versions.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. GitHub commits and pull requests also offer insights into the fixes implemented.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.