CVE-2026-107282

Received Received - Intake

Cross-Host Request Replay in AsyncHttpClient

Publication date: 2026-10-07

Last updated on: 2026-10-07

Assigner: GitHub, Inc.

Description

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, cross-host request replay updates the current request but leaves the target request and related proxy context pointing at the original origin. Connection-pool selection, CONNECT handling, realm selection, and TLS setup can consequently send the original host's path, Host header, Authorization credentials, or plaintext request to the replay destination. Documented ResponseFilter failover and retry paths can trigger the replay. This issue is fixed in versions 3.0.13 and 2.16.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-07

Last Modified

2026-10-07

Generated

2026-10-08

AI Q&A

2026-10-08

EPSS Evaluated

N/A

NVD

CVE-2026-107282

Affected Vendors & Products

Vendor	Product	Version / Range
AsyncHttpClient	async-http-client	>= 3.0.0, < 3.0.13
AsyncHttpClient	async-http-client	>= 2.0.0, < 2.16.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-522	The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
CWE-319	The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
CWE-441	The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor.

Attack-Flow Graph

Executive Summary

This vulnerability in AsyncHttpClient (AHC) allows a cross-host request replay where the current request is updated but the target request and proxy context still point to the original host. This can cause sensitive data like host paths, headers, or credentials to be sent to the wrong destination.

Detection Guidance

This vulnerability can be detected by checking the version of AsyncHttpClient in use. If your application uses versions prior to 3.0.13 or 2.16.1, it is vulnerable. Commands to check the version depend on your build tool. For Maven, run: mvn dependency:tree | grep async-http-client. For Gradle, run: gradle dependencies | grep async-http-client.

Impact Analysis

An attacker could exploit this to send your application's requests to unintended servers, potentially exposing sensitive data such as authentication credentials, host paths, or plaintext requests. This could lead to data breaches or unauthorized access.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Non-compliance may result in legal penalties or reputational damage.

Mitigation Strategies

Immediately upgrade AsyncHttpClient to version 3.0.13 or 2.16.1 or later. Review application code for use of ResponseFilter failover and retry paths, as these can trigger the vulnerability. Ensure no sensitive data is exposed during requests.

Hi! I’m here to help you understand CVE-2026-107282. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70