CVE-2026-107281CWE-346CWE-863broken-access-control

CVE-2026-107281

published October 8, 2026

CVSS

7.6

EPSS

Percentile

6.1

In the wild

Unconfirmed

What it is

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, the HTTP/1.1 connection-pool key excludes the authenticated principal for connection-oriented NTLM and Negotiate authentication. A pooled socket authenticated for one request can be reused by a request carrying another principal, and the server executes that later request as the first identity. Basic and Digest are not affected because they authenticate each request. This issue is fixed in versions 3.0.13 and 2.16.1.

The record

Technical detail

CVSS: 7.6 · NONE
CVSS v4.0: 7.6 · CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS: 0.00171 · 6.1th percentile
Weaknesses: CWE-346 · Origin Validation Error; CWE-863 · Incorrect Authorization
Published: 2026-10-08T02:17Z

References (5)

https://github.com/AsyncHttpClient/async-http-client/commit/73813babf51231ee79f7da4f07b777f19f48d34d · [email protected]https://github.com/AsyncHttpClient/async-http-client/commit/83e552e64cabab2119addb6b47f7c6482997c94e · [email protected]https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-2.16.1 · [email protected]https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.13 · [email protected]https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-vvp4-63h8-v5pm · [email protected]

EPSS history

Timeline

09 OCT 03:26Z
EPSS moved — → 0%
epss
07 OCT 21:19Z
AsyncHttpClient: Connection pool key omits the authenticated principal, so an NTLM or Negotiate connection is reused across identities
cvelistv5
07 OCT 21:19Z
AsyncHttpClient: Connection pool key omits the authenticated principal, so an NTLM or Negotiate connection is reused across identities
cvelistv5