CVE-2026-107279
Severity not reportedThe AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses.
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. In 3.0.12, a peer offering only Digest qop=auth-int causes mutual-authentication verification to be skipped. AuthenticatorUtils.computeExpectedRspAuth returns no expected value for auth-int, and Interceptors treats that result as unverifiable but nonfatal, so a response with an invalid rspauth value is accepted. A peer that does not know the shared secret can therefore be accepted as the authenticated server. This issue is fixed in version 3.0.13.
Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/AsyncHttpClient/async-http-client/commit/a5422493b638226666a1ecb5f82826... security-advisories@github.com
- https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-projec... security-advisories@github.com
- https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-qhv6-3pmh-95... security-advisories@github.com