CVE-2026-102740
Received Received - Intake

Path Traversal in AsyncHttpClient via ResumableAsyncHandler

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description
The AsyncHttpClient library allows Java applications to execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 and 3.0.12, PropertiesBasedResumableProcessor stores resumable download state at the predictable shared path $java.io.tmpdir/ahc/ResumableAsyncHandler.properties with default permissions and link-following file operations. A local user who can read the shared store can see download URLs, including embedded user information or query tokens. A local user who can write within or pre-create the affected shared store directory can plant a symbolic link that the client follows when saving state, truncating and overwriting a target file writable by the client process. The filesystem path is used when ResumableAsyncHandler decorates another AsyncHandler, while the no-argument constructors use a no-op processor and are unaffected. This issue is fixed in versions 2.16.1 and 3.0.12.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-16
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-102740
EUVD
EUVD-2026-102223

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
AsyncHttpClient async-http-client >= 2.0.0, < 2.16.1
AsyncHttpClient async-http-client >= 3.0.0, < 3.0.12

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-732 The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
CWE-61 The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.
CWE-379 The product creates a temporary file in a directory whose permissions allow unintended actors to determine the file's existence or otherwise access that file.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the AsyncHttpClient library versions 2.0.0 to 2.16.0 and 3.0.0 to 3.0.11. It involves the PropertiesBasedResumableProcessor component storing resumable download state in a predictable shared path within the system's temporary directory. The file is created with default permissions, making it readable by any local user. Attackers can exploit this to read sensitive URLs containing user credentials or tokens, or plant symbolic links to overwrite arbitrary files writable by the client process.

Detection Guidance

Check for the existence of the predictable file path $java.io.tmpdir/ahc/ResumableAsyncHandler.properties. On Unix-like systems, use 'ls -la $TMPDIR/ahc/' to inspect permissions and ownership. Verify if the file is world-readable or writable by others. Also check for unexpected symlinks in the path using 'ls -l $TMPDIR/ahc/ResumableAsyncHandler.properties'.

Impact Analysis

If you use affected versions of AsyncHttpClient, local attackers on shared systems could read sensitive download URLs, including embedded credentials or tokens. They could also overwrite critical files by exploiting a symlink race condition, potentially causing data corruption or unauthorized access to your system files.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, such as user credentials or tokens embedded in URLs. This may violate GDPR's data protection principles or HIPAA's requirements for safeguarding protected health information, potentially resulting in compliance breaches and legal consequences.

Mitigation Strategies

Upgrade AsyncHttpClient to version 2.16.1 or 3.0.12 or later. If upgrading is not possible, avoid using ResumableAsyncHandler in shared environments. Configure the resumable download directory to use a private, non-shared location with strict permissions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-102740. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart