async-http-client: Digest mutual authentication bypass via qop=auth-int
Summary
The AsyncHttpClient Java library (version 3.0.12) skips the verification of the server's rspauth value when the server offers only Digest qop=auth-int. The client accepts a response with an invalid rspauth value and treats it as nonfatal. A peer that does not know the shared secret can therefore be accepted as the authenticated server, which allows a man-in-the-middle to impersonate the server.
Affected
- AsyncHttpClient async-http-client 3.0.12
Fixed in
- async-http-client 3.0.13
Workaround
Unknown.
Exploitation
- CISA SSVC: exploitation none, automatable no, technical impact partial.
- No public exploitation known at the time of research.
Our recommendation
- Upgrade async-http-client to version 3.0.13 or later.
- Identify applications that use this library (e.g. the Maven artifact org.asynchttpclient:async-http-client) and prioritise those that use Digest authentication against servers.
- Note that since 3.0.13 a server offering only qop=auth-int can no longer be authenticated against; test affected integrations after the upgrade.
- Review the release notes for further security fixes in 3.0.13.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub commit a542249 (fix) github.com
- AHC v3.0.13 release notes github.com
- GitHub Security Advisory GHSA-qhv6-3pmh-95q4 github.com
- OSV entry CVE-2026-107279 osv.dev
- Ubuntu security notice CVE-2026-107279 ubuntu.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 21:15.
Original description (NVD)
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. In 3.0.12, a peer offering only Digest qop=auth-int causes mutual-authentication verification to be skipped. AuthenticatorUtils.computeExpectedRspAuth returns no expected value for auth-int, and Interceptors treats that result as unverifiable but nonfatal, so a response with an invalid rspauth value is accepted. A peer that does not know the shared secret can therefore be accepted as the authenticated server. This issue is fixed in version 3.0.13.
NVD references (3)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.