AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, cross-host request replay updates the current request but leaves the target request and related proxy context pointing at the original origin. Connection-pool selection, CONNECT handling, realm selection, and TLS setup can consequently send the original host's path, Host header, Authorization credentials, or plaintext request to the replay destination. Documented ResponseFilter failover and retry paths can trigger the replay. This issue is fixed in versions 3.0.13 and 2.16.1.
CVE-2026-107282
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-107282
async-http-client
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "AsyncHttpClient",
"product": "async-http-client",
"versions": [
{
"status": "affected",
"version": ">= 3.0.0, < 3.0.13"
},
{
"status": "affected",
"version": ">= 2.0.0, < 2.16.1"
}
]
}
]- Related CVEs
- CVE-2026-107282
Source reference:
/cveMetadata/cveId
Publisher severity
critical
Source reference: /containers/cna/metrics
- Event
- #16550 · Revision 1
- Added to Heist Feed
- Publisher date