CVE-2026-107232: AsyncHttpClient: Origin credentials sent in cleartext to a proxy that rejects the CONNECT
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 on 3.x and 2.16.1 on 2.x, the client infers that an HTTP proxy tunnel exists from the last request method rather than the CONNECT result. After a proxy rejects CONNECT, redirect or authentication handlers can write an origin request and its Authorization credentials onto the still-plaintext proxy connection. Basic credentials can be recovered directly, while NTLM responses may be cracked or relayed. This issue is fixed in versions 3.0.12 and 2.16.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
AsyncHttpClientto a version that resolves this vulnerability.Fixed in 3.0.12 - Upgrade
Upgrade
AsyncHttpClientto a version that resolves this vulnerability.Fixed in 2.16.1
Event History
Frequently Asked Questions
Which deployments are exposed?
Java applications using AsyncHttpClient 3.x before 3.0.12 or 2.x before 2.16.1 are affected when they use an HTTP proxy and send origin Authorization credentials. Exposure occurs when the proxy rejects a CONNECT request and the client then follows redirect or authentication handling.
What can a malicious or untrusted proxy obtain?
The proxy can receive an origin request and its Authorization credentials over the still-plaintext proxy connection after rejecting CONNECT. Basic credentials can be recovered directly; NTLM responses may be cracked or relayed.
Does exploitation require prior authentication or user interaction?
No. The supplied vector specifies network attack, low complexity, no privileges required, and no user interaction. The relevant condition is a proxy rejecting CONNECT while the client subsequently sends an origin request through redirect or authentication handling.
How should this be remediated?
Upgrade AsyncHttpClient 3.x to 3.0.12 or later, or 2.x to 2.16.1 or later. These versions contain the fix.