CVE-2026-107281
HIGH 7.6The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, the HTTP/1.1 connection-pool key excludes the authenticated principal for connection-oriented NTLM and Negotiate authentication. A pooled socket authenticated for one request can be reused by a request carrying another principal, and the server executes that later request as the first identity. Basic and Digest are not affected because they authenticate each request. This issue is fixed in versions 3.0.13 and 2.16.1.
Severe if exploited (CVSS 7.6), but no known exploitation and low modeled probability. Patch on a normal cadence.
Exploitation likelihood
0.2%chance of exploitation in 30 days · 6th percentile
Impact if exploited
7.6CVSS 4.0 · HIGH
- ConfidentialityHigh
- IntegrityHigh
- AvailabilityNone
What an attacker needs
- ✓Access: Reachable over the network — no local access needed
- ⚠Privileges: Requires a low-privilege account
- ✓User interaction: No user interaction needed
- ⚠Complexity: Needs a race window or specific setup
- ⚠Requirements: Specific conditions must be present
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Data snapshot:
Weakness (CWE)
- CWE-346: : Origin Validation Error
- CWE-863: : Incorrect Authorization
CVSS vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
References and research data (JSON)
All CVSS metrics
- HIGH 7.6 v4.0 · CNA Primary
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N - HIGH 7.6 v4.0 · NVD Secondary
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
References
Advisories
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-94640 EUVD · EUVD-2026-94640
Technical & other
- https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-vvp4-63h8-v5pm CVE record · GitHub_M · Updated 2026-10-07T21:19:09.292Z
NVD · CVE-2026-107281 · Updated 2026-10-08T20:35:31.200 - https://github.com/AsyncHttpClient/async-http-client/commit/73813babf51231ee79f7da4f07b777f19f48d34d CVE record · GitHub_M · Updated 2026-10-07T21:19:09.292Z
NVD · CVE-2026-107281 · Updated 2026-10-08T20:35:31.200 - https://github.com/AsyncHttpClient/async-http-client/commit/83e552e64cabab2119addb6b47f7c6482997c94e CVE record · GitHub_M · Updated 2026-10-07T21:19:09.292Z
NVD · CVE-2026-107281 · Updated 2026-10-08T20:35:31.200 - https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-2.16.1 CVE record · GitHub_M · Updated 2026-10-07T21:19:09.292Z
NVD · CVE-2026-107281 · Updated 2026-10-08T20:35:31.200 - https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.13 CVE record · GitHub_M · Updated 2026-10-07T21:19:09.292Z
NVD · CVE-2026-107281 · Updated 2026-10-08T20:35:31.200