critical vulnerability

AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host

Fix availableCritical · CVSS 9.4EPSS 0.19%

Published Oct 8, 2026 · updated Oct 8, 2026

What to do

Upgrade to a fixed version: org.asynchttpclient:async-http-client 3.0.13, org.asynchttpclient:async-http-client 2.16.1.
Redeploy and restart long-running processes so they load the fixed code.

Affected packages

Mavenorg.asynchttpclient:async-http-client

Vulnerable versions: >= 3.0.0, <= 3.0.12
Fixed in: 3.0.13

Check your project: mvn dependency:tree -Dincludes=org.asynchttpclient:async-http-client

Mavenorg.asynchttpclient:async-http-client

Vulnerable versions: >= 2.0.0, <= 2.16.0
Fixed in: 2.16.1

Check your project: mvn dependency:tree -Dincludes=org.asynchttpclient:async-http-client

Sources

CWE-319 Cleartext Transmission of Sensitive Information · CWE-441 Unintended Proxy or Intermediary ('Confused Deputy') · CWE-522 Insufficiently Protected Credentials

← All critical vulnerabilities