CVE-2026-85719: AsyncHttpClient: SOCKS proxy credentials sent to the origin server over plaintext HTTP
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 2.16.1 and 3.0.12, requests using an authenticated SOCKS proxy can expose the proxy's credentials to the origin because NettyRequestFactory and NettyRequestSender attach Proxy-Authorization without confirming that the request is being sent to an HTTP proxy. With preemptive proxy authentication, the header is attached to a plaintext HTTP request, exposing credentials such as directly reversible Basic credentials to the origin. With the default non-preemptive flow, a hostile origin can return a 407 response and ProxyUnauthorized407Interceptor sends the proxy credentials through the existing SOCKS tunnel, including NTLM, Kerberos, and SPNEGO credentials. Releases before 2.1.0 lack SOCKS proxy support. This issue is fixed in versions 2.16.1 and 3.0.12.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.16.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.0.12
Event History
Frequently Asked Questions
Which deployments are exposed?
Java applications using AsyncHttpClient with an authenticated SOCKS proxy are affected in versions 2.1.0 through 2.16.1 and in 3.x before 3.0.12. Releases before 2.1.0 do not support SOCKS proxies.
Does the default proxy-authentication behavior avoid exposure?
No. In the default non-preemptive flow, a hostile origin can return a 407 response and cause proxy credentials to be sent through the existing SOCKS tunnel. This can include NTLM, Kerberos, and SPNEGO credentials.
What conditions make credential disclosure possible?
The application must use an authenticated SOCKS proxy and make requests to an origin controlled or influenced by an attacker. With preemptive authentication, Proxy-Authorization is attached to plaintext HTTP requests, allowing the origin to receive credentials such as reversibly encoded Basic credentials.
What should be done if immediate patching is not possible?
Avoid using authenticated SOCKS proxies with affected AsyncHttpClient releases, especially for plaintext HTTP requests and requests to untrusted origins. Upgrade to 2.16.1 or 3.0.12 when possible.