CVE-2026-107231CWE-319CWE-522CWE-757

CVE-2026-107231

published October 8, 2026

CVSS

8.7

EPSS

Percentile

13.9

In the wild

Unconfirmed

What it is

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, Realm.Builder treats a Digest challenge that yields no usable nonce as a Basic challenge. A malicious origin or proxy can label a challenge Digest while omitting or emptying the nonce, causing the client to resend the username and password using reversible Basic authentication. Both origin and proxy challenge parsers are affected. This issue is fixed in versions 3.0.13 and 2.16.1.

The record

Technical detail

CVSS: 8.7 · NONE
CVSS v4.0: 8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS: 0.00237 · 13.9th percentile
Weaknesses: CWE-319 · Cleartext Transmission of Sensitive Information; CWE-522 · Insufficiently Protected Credentials; CWE-757 · Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')
Published: 2026-10-08T02:17Z

References (5)

https://github.com/AsyncHttpClient/async-http-client/commit/8376866aa9b5a7653ad19db9d472692f875caa83 · [email protected]https://github.com/AsyncHttpClient/async-http-client/commit/c8d639bf6ac341d377d610a93570bcd15565f1a6 · [email protected]https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-2.16.1 · [email protected]https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.13 · [email protected]https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-rqf5-2wxv-rjf4 · [email protected]

EPSS history

Timeline

09 OCT 03:26Z
EPSS moved — → 0%
epss
07 OCT 21:06Z
AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext
cvelistv5
07 OCT 21:06Z
AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext
cvelistv5