CVE-2026-107230: AsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy logins
Impact The fix for GHSA-vvp4-63h8-v5pm in 3.0.13 folded the authenticated principal into the HTTP/1.1 connection pool key, so that a connection one principal authenticated with NTLM, Kerberos or SPNEGO is not handed to another. It left three cases out. In each, a socket that one identity authenticated can still be drawn by a request belonging to a different identity, and the server serves that request as the first one.
1. A login with no configured principal. Kerberos and SPNEGO against the ticket cache or the default JAAS login, which is the usual deployment, leave the realm's principal unset, and the key stayed unscoped in that case. A request to the same host that carries no credentials at all draws the authenticated socket and is served as the service identity. 2. The proxy realm. Only the origin realm went into the key. A connection authenticated to a proxy with NTLM or Negotiate is handed to requests of another proxy identity, or of none, and the proxy acts for them as the first identity. 3. Identities that share a user name. Only the principal string went into the key, so CORP\alice and OTHER\alice shared connections, as did two realms differing only in password, login context, keytab or service principal. The Kerberos login cache in SpnegoEngine had the same collision, and it was an unsynchronised map, so concurrent first use could hand one caller's login to another.
Who is Impacted Applications that authenticate with NTLM, Kerberos or SPNEGO, to an origin or to a proxy, and send requests under different identities, or both with and without credentials, to the same host through one client. The sharpest case is a service that calls an internal host under its own Kerberos identity and also fetches user-supplied URLs: a URL on that host is fetched as the service. Basic and Digest are not affected.
Affected versions 3.x: 3.0.13 2.x: 2.16.1
Earlier versions are covered by GHSA-vvp4-63h8-v5pm.
Patches Fixed in 3.0.14. The pool key now carries a digest of every field of the realm that decides which identity the connection ends up as, for the origin and the proxy separately, and a realm that authenticates the connection is scoped whether or not it names a principal. SpnegoEngine caches logins in a concurrent map keyed by every other field of that identity, and replaces a cached login when the password changes.
The 2.x line is end of life and will not receive a fix. Upgrade to 3.0.14.
Workarounds Use a separate AsyncHttpClient instance per identity, and do not share one between authenticated and unauthenticated requests to a host that uses NTLM or Negotiate. Disabling connection pooling also removes the reuse.
Incomplete fix of GHSA-vvp4-63h8-v5pm.
Other sources
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 3.0.14, connection-pool partitioning still omits identity-defining fields for Kerberos, SPNEGO, NTLM, and authenticated proxy connections. Logins without a configured principal, proxy realms, identities sharing a user name, and SOCKS or CONNECT proxy logins can reuse a socket authenticated as a different identity. A later request is then executed under the first identity and can expose that identity's data or authority to another caller. In the affected execution path, SpnegoEngine, NTLM, Kerberos, SPNEGO, SOCKS, and CONNECT control or expose the vulnerable behavior. This issue is fixed in version 3.0.14.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.asynchttpclient:async-http-clientto a version that resolves this vulnerability.Fixed in 3.0.14 - Upgrade
Upgrade
AsyncHttpClientto a version that resolves this vulnerability.Fixed in 3.0.14 - Compensating control
Disable connection pooling, or use a separate AsyncHttpClient instance per identity and do not share one between authenticated and unauthenticated requests to a host using NTLM or Negotiate.
Event History
Frequently Asked Questions
Which applications are realistically exposed to cross-identity request execution?
Java applications using AsyncHttpClient versions 2.0.0 through 3.0.13 are exposed when pooled connections are used with Kerberos, SPNEGO, NTLM, or authenticated proxy connections. Risk is concentrated where multiple caller identities can share the same client or connection pool.
What conditions can trigger reuse of a connection authenticated as another identity?
The affected cases include logins without a configured principal, proxy realms, identities that share a user name, and SOCKS or CONNECT proxy logins. A later request can reuse a socket authenticated for the first identity and run with that identity's data access or authority.
Are unauthenticated deployments affected?
The described vulnerable behavior concerns pooled connections using Kerberos, SPNEGO, NTLM, or authenticated proxy logins. The provided information does not identify unauthenticated request paths as affected.
What is the available remediation?
Upgrade AsyncHttpClient to version 3.0.14, which fixes the issue. The affected version range begins at 2.0.0 and ends before 3.0.14.