AsyncHttpClient async-http-client: Credential and request leak on cross-host replay
Summary
AsyncHttpClient (AHC), a Java library for outbound HTTP calls, does not update the target, proxy and connection pool context when a request is replayed to a different host. Requests can then carry the original host's path, Host header, Authorization credentials or plaintext content to the replay destination. The flaw is triggered through documented ResponseFilter failover and retry paths, so it only matters where an application uses these and an attacker can influence the replay target.
Affected
- async-http-client 3.0.0 to before 3.0.13
- async-http-client 2.0.0 to before 2.16.1
- Downstream products that embed these versions (check dependency trees, e.g. Red Hat Fuse 7 and Debian bookworm package 2.12.3-1 as reported by mirrors; affected status of vendor builds unknown)
Fixed in
- async-http-client 3.0.13
- async-http-client 2.16.1
- Downstream fixed package builds: Unknown.
Workaround
- Where the application does not need ResponseFilter failover or retry paths, disable or remove cross-host replay and retry mechanisms.
- No other vendor-approved workaround is known.
Exploitation
- CISA SSVC: exploitation none, automatable yes, technical impact total.
- Not listed in CISA KEV; not marked as known exploited by the Hol.org feed.
- No public proof of concept found; this is not a confirmed absence.
- EPSS score 0.00189.
Our recommendation
- Inventory Java applications and dependencies (SBOM, transitive dependencies) to find async-http-client.
- Upgrade to 3.0.13 or 2.16.1; do not stop at a nearby release.
- Where patching is not immediately possible, disable ResponseFilter failover and retry paths that replay to other hosts.
- Review applications that send credentials through such replays and rotate credentials if misdirection is suspected.
- Monitor outbound connections for unexpected destinations.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-jmqq-x5g9-9p2w github.com
- Fix commit 15b2545 (replay target and proxy) github.com
- Fix commit bbc31ae (replay target and proxy) github.com
- Release 3.0.13 github.com
- Release 2.16.1 github.com
- OSV GHSA-jmqq-x5g9-9p2w osv.dev
- Hol.org CVE record hol.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 00:12.
Original description (NVD)
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, cross-host request replay updates the current request but leaves the target request and related proxy context pointing at the original origin. Connection-pool selection, CONNECT handling, realm selection, and TLS setup can consequently send the original host's path, Host header, Authorization credentials, or plaintext request to the replay destination. Documented ResponseFilter failover and retry paths can trigger the replay. This issue is fixed in versions 3.0.13 and 2.16.1.
NVD references (5)
- https://github.com/AsyncHttpClient/async-http-client/commit/15b254514a411623e5f1d8c99ea79c0f82f8a466
- https://github.com/AsyncHttpClient/async-http-client/commit/bbc31aed3b044f9f7a126cf689a8c8d7ad2ae1cb
- https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-2.16.1
- https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.13
- https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-jmqq-x5g9-9p2w
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.