| Name | CVE-2026-107230 |
| Description | The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 3.0.14, connection-pool partitioning still omits identity-defining fields for Kerberos, SPNEGO, NTLM, and authenticated proxy connections. Logins without a configured principal, proxy realms, identities sharing a user name, and SOCKS or CONNECT proxy logins can reuse a socket authenticated as a different identity. A later request is then executed under the first identity and can expose that identity's data or authority to another caller. In the affected execution path, SpnegoEngine, NTLM, Kerberos, SPNEGO, SOCKS, and CONNECT control or expose the vulnerable behavior. This issue is fixed in version 3.0.14. |
| Source | CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| Debian Bugs | 1150331 |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| async-http-client (PTS) | bookworm (security) | 2.12.3-1+deb12u1 | vulnerable |
| sid, bookworm | 2.12.3-1 | vulnerable |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| async-http-client | source | (unstable) | (unfixed) | 1150331 |
https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-v2j5-22fr-j62r
https://github.com/AsyncHttpClient/async-http-client/commit/d3bb4d68b41acf5d3ab7541afa9fdfe7ec3ba054 (async-http-client-project-3.0.14)
4 cases of issues, where a the first set 1-3 is covered by GHSA-vvp4-63h8-v5pm.
The fourth case (Any login on a SOCKS or CONNECT proxy) will not be fixed in the 2.x line
(end-of-life) and needs an upgrade to at least 3.0.14