CVE-2026-107232

Received Received - Intake

AsyncHttpClient Proxy Tunnel Credential Exposure

Publication date: 2026-10-07

Last updated on: 2026-10-07

Assigner: GitHub, Inc.

Description

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 on 3.x and 2.16.1 on 2.x, the client infers that an HTTP proxy tunnel exists from the last request method rather than the CONNECT result. After a proxy rejects CONNECT, redirect or authentication handlers can write an origin request and its Authorization credentials onto the still-plaintext proxy connection. Basic credentials can be recovered directly, while NTLM responses may be cracked or relayed. This issue is fixed in versions 3.0.12 and 2.16.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-07

Last Modified

2026-10-07

Generated

2026-10-08

AI Q&A

2026-10-08

EPSS Evaluated

N/A

NVD

CVE-2026-107232

Affected Vendors & Products

Vendor	Product	Version / Range
AsyncHttpClient	async-http-client	>= 3.0.0, < 3.0.12
AsyncHttpClient	async-http-client	>= 2.0.0, < 2.16.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-522	The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
CWE-319	The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
CWE-441	The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor.

Attack-Flow Graph

Executive Summary

The AsyncHttpClient (AHC) library before versions 3.0.12 (3.x) and 2.16.1 (2.x) has a flaw where it incorrectly infers the existence of an HTTP proxy tunnel based on the last request method instead of the CONNECT result. This can lead to security issues where, after a proxy rejects a CONNECT request, redirect or authentication handlers may send an origin request with Authorization credentials over an unencrypted proxy connection. Basic credentials can be exposed directly, while NTLM responses might be cracked or relayed.

Detection Guidance

Detecting this vulnerability requires checking the AsyncHttpClient library version in use. Inspect your project dependencies for versions prior to 3.0.12 (3.x) or 2.16.1 (2.x). Commands like 'mvn dependency:tree' for Maven or 'gradle dependencies' for Gradle can help identify the version. If vulnerable versions are found, update to the patched versions immediately.

Impact Analysis

This vulnerability could allow attackers to intercept and steal credentials sent over a proxy connection. If you use AsyncHttpClient in a Java application with a proxy, an attacker might recover Basic authentication credentials directly or exploit NTLM responses for further attacks like credential relaying or cracking.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements under GDPR and HIPAA. Exposure of credentials or relayed authentication may result in data breaches, triggering compliance violations and potential legal penalties.

Mitigation Strategies

Upgrade AsyncHttpClient to version 3.0.12 or later for 3.x branch, or 2.16.1 or later for 2.x branch to address the proxy tunnel handling flaw.

Hi! I’m here to help you understand CVE-2026-107232. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70