CVE-2026-85720 AsyncHttpClient CVE debrief

Who should care

Defenders responsible for Java applications using AsyncHttpClient should assess the vulnerability and prioritize updates to affected versions. Defenders should verify exposure in Java applications using AsyncHttpClient versions between 2.0.0 and 2.16.1 or 3.0.12, and assess the need for updates to 2.16.1 or 3.0.12. The vulnerability affects versions 2.0.0 to 2.16.1 and 3.0.12.

Why it matters

CVE-2026-85720 exposes preemptive origin credentials in AsyncHttpClient, requiring defenders to verify exposure and prioritize updates.

• Credential exposure in HTTP requests
• Potential for unauthorized access to origin credentials
• Need for verification of AsyncHttpClient versions in use
• Priority for updating vulnerable versions to 2.16.1 or 3.0.12

Technical summary

The AsyncHttpClient library allows Java applications to execute HTTP requests and process HTTP responses asynchronously. A vulnerability in versions 2.0.0 to 2.16.1 and 3.0.12 exposes preemptive origin credentials when using an HTTP proxy to reach an HTTPS origin. This issue is fixed in versions 2.16.1 and 3.0.12. The vulnerability allows preemptive origin credentials to be exposed when using an HTTP proxy to reach an HTTPS origin. The tunneled request still receives origin Authorization after the tunnel is established, while Proxy-Authorization remains on CONNECT for its intended proxy recipient.

Defensive priority

Defenders should prioritize verifying exposure in Java applications using AsyncHttpClient versions between 2.0.0 and 2.16.1 or 3.0.12, and assess the need for updates to 2.16.1 or 3.0.12.

Recommended defensive actions

• Verify the version of AsyncHttpClient used in Java applications and update to 2.16.1 or 3.0.12 if necessary.
• Assess the exposure of preemptive origin credentials in HTTP requests using AsyncHttpClient.
• Review and update defensive configurations to prevent credential exposure.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in AsyncHttpClient, which allows preemptive origin credentials to be exposed when using an HTTP proxy to reach an HTTPS origin. The vulnerability affects versions 2.0.0 to 2.16.1 and 3.0.12. Defenders should verify exposure in Java applications using AsyncHttpClient versions between 2.0.0 and 2.16.1 or 3.0.12, and assess the need for updates to 2.16.1 or 3.0.12. The CVE record was published on 2026-09-17T17:16:51.200Z and has not been modified since then. The NVD entry

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.