IT SBIT Services
Schneeberger
DEEN
CVE tracker

AsyncHttpClient async-http-client: Digest challenge downgrade to Basic exposes password

CVE-2026-107231High 8.7

← All vulnerabilities

Summary

AsyncHttpClient is a Java library for asynchronous HTTP requests. A Digest challenge without a usable nonce was treated as a Basic challenge, so the client resent the username and password base64 encoded, which is easily reversible. An attacker able to send HTTP challenges, such as a malicious or compromised origin server, a proxy, or an attacker on a plaintext network path, can obtain these credentials without user interaction.

Affected

  • async-http-client 2.x from 2.0.0 up to 2.16.0
  • async-http-client 3.x from 3.0.0.Beta1 up to 3.0.12

Fixed in

  • 2.16.1
  • 3.0.13
  • Note: the advisory names only these two fixed versions; 3.0.14 exists but was not verified against this CVE.

Workaround

  • Upgrading is the recommended fix.
  • If patching is not possible, configure the application to reject Basic authentication where only Digest is expected, and force authentication over TLS.

Exploitation

  • No known exploitation in the wild, and no public proof of concept found in the sources reviewed.
  • The CISA SSVC assessment lists exploitation as none and automatable as yes.
  • The CISA KEV catalogue was not checked directly.

Our recommendation

  • Inventory Java applications and SBOMs for org.asynchttpclient:async-http-client, including transitive dependencies.
  • Flag versions below 2.16.1 (2.x line) or below 3.0.13 (3.x line).
  • Upgrade to 3.0.13 or later, or 2.16.1 for the 2.x line, after regression testing.
  • Where a vulnerable version has sent credentials over untrusted networks, consider rotating those credentials.
  • Prioritise integrations that call third-party endpoints, use outbound proxies or plain HTTP.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 05:23.

Original description (NVD)

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, Realm.Builder treats a Digest challenge that yields no usable nonce as a Basic challenge. A malicious origin or proxy can label a challenge Digest while omitting or emptying the nonce, causing the client to resend the username and password using reversible Basic authentication. Both origin and proxy challenge parsers are affected. This issue is fixed in versions 3.0.13 and 2.16.1.

NVD references (5)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed