CVE-2026-85717

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-85717
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-85717.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-85717
Aliases
Downstream
CGA (16)
UBUNTU (1)
Published
2026-09-17T15:53:39Z
Modified
2026-09-24T08:05:02Z
Severity
  • 6.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N CVSS Calculator
Summary
AsyncHttpClient: Client-wide realm credentials re-sent to a cross-origin redirect target
Details

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.14.5 to 2.16.0 and from 3.0.9 to 3.0.11, a client configured with a client-wide Realm and redirect following can disclose credentials after a cross-origin redirect because the Interceptors authentication path falls back to the client configuration after redirect handling clears the per-exchange realm. If the attacker-controlled target returns 401, the client can send Basic or Digest credentials or a Negotiate or NTLM token to that origin. Per-request realms are stripped correctly, and this issue is a residual bypass of the earlier cross-origin credential-stripping fixes. This issue is fixed in versions 2.16.1 and 3.0.12.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-200",
        "CWE-522"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85717.json"
}
References

Affected packages

Git / github.com/asynchttpclient/async-http-client

Affected ranges

Type
GIT
Repo
https://github.com/asynchttpclient/async-http-client
Events
Introduced
ae557ad35246721c09dafb2976609cd0004e78ae
Introduced
1ab1ea31fcaa0b016130d9f08cd5334feb2d1d93
Fixed
d1f0ccec417092098d40242fee7dfac84bb3c21f
Fixed
c07038b44e5206375662b46859672e8f1df9f05a
Fixed
43db7bba81430cbd61ec2dc2c7be464e0ff6a0ff
Fixed
b66757bec34def2e9867bb2b77bd848b1112abb4
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "2.14.5"
        },
        {
            "fixed":  "2.16.1"
        },
        {
            "introduced":  "3.0.9"
        },
        {
            "fixed":  "3.0.12"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

async-http-client-project-2.*
async-http-client-project-2.14.5
async-http-client-project-2.15.0
async-http-client-project-2.16.0
async-http-client-project-3.*
async-http-client-project-3.0.10
async-http-client-project-3.0.11
async-http-client-project-3.0.9

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-85717.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "219246596221720898981563676126452787927",
                "112413554918931264338179563940130289539",
                "262908889413526511266896616639455764237"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-85717-26220b3f",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/asynchttpclient/async-http-client/commit/d1f0ccec417092098d40242fee7dfac84bb3c21f",
        "target":  {
            "file":  "client/src/main/java/org/asynchttpclient/cookie/ThreadSafeCookieStore.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "184009208900755675943023404748893370663",
            "length":  4882
        },
        "id":  "CVE-2026-85717-2cd752fd",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/asynchttpclient/async-http-client/commit/43db7bba81430cbd61ec2dc2c7be464e0ff6a0ff",
        "target":  {
            "file":  "client/src/test/java/org/asynchttpclient/RedirectCredentialSecurityTest.java",
            "function":  "startServers"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "241393853802948463620791340251047477124",
            "length":  5325
        },
        "id":  "CVE-2026-85717-5545403e",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/asynchttpclient/async-http-client/commit/b66757bec34def2e9867bb2b77bd848b1112abb4",
        "target":  {
            "file":  "client/src/test/java/org/asynchttpclient/RedirectCredentialSecurityTest.java",
            "function":  "startServers"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "76474214396730061469783811740400741500",
                "204603471147328128174695634701278902105",
                "68384609722284682341058103555844221330",
                "282810287519263333484570046753837592032",
                "81671904131358807237731526954193979982",
                "251938332087782189967162072465881740844",
                "100736082375505397084409997457753738898",
                "49137876904396146127075179432178697958",
                "107453322290419343400819515691789716070",
                "90528517945449657848656305410295890180",
                "197607451851055902265844210649427662551",
                "94809090037378499247250609020830998758",
                "45463429962871820414932086669367837580"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-85717-7ab65a47",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/asynchttpclient/async-http-client/commit/43db7bba81430cbd61ec2dc2c7be464e0ff6a0ff",
        "target":  {
            "file":  "client/src/test/java/org/asynchttpclient/RedirectCredentialSecurityTest.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "212258540344916751724864665431810523374",
            "length":  1478
        },
        "id":  "CVE-2026-85717-81d12158",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/asynchttpclient/async-http-client/commit/43db7bba81430cbd61ec2dc2c7be464e0ff6a0ff",
        "target":  {
            "file":  "client/src/main/java/org/asynchttpclient/netty/handler/intercept/Interceptors.java",
            "function":  "exitAfterIntercept"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "225565141248320595934937395809500783613",
                "242343515445931555414066584996557268149",
                "163715264400786534397493848134757466046",
                "40179504555055141142828355367061676436"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-85717-c14fd6ca",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/asynchttpclient/async-http-client/commit/b66757bec34def2e9867bb2b77bd848b1112abb4",
        "target":  {
            "file":  "client/src/main/java/org/asynchttpclient/netty/handler/intercept/Interceptors.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "54289836295184197265711419203810783766",
                "235445810451018097122068040748536847398",
                "70669224714332450542924553577060680104",
                "285543063446836095755120805065194255136",
                "141857047890905438563829620685494211698",
                "190300941236298590702403977605206298263",
                "164123811326698259967112625327587301246",
                "66334450511794396711415949674297370618",
                "12155388834262985759899981192895395181",
                "321860887365735582908914497695102329178"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-85717-c266ee0c",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/asynchttpclient/async-http-client/commit/b66757bec34def2e9867bb2b77bd848b1112abb4",
        "target":  {
            "file":  "client/src/test/java/org/asynchttpclient/RedirectCredentialSecurityTest.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "319981061666573934872902157208912328509",
            "length":  685
        },
        "id":  "CVE-2026-85717-c7b286ac",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/asynchttpclient/async-http-client/commit/d1f0ccec417092098d40242fee7dfac84bb3c21f",
        "target":  {
            "file":  "client/src/main/java/org/asynchttpclient/cookie/ThreadSafeCookieStore.java",
            "function":  "add"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "225565141248320595934937395809500783613",
                "242343515445931555414066584996557268149",
                "163715264400786534397493848134757466046",
                "40179504555055141142828355367061676436"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-85717-d1269e89",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/asynchttpclient/async-http-client/commit/43db7bba81430cbd61ec2dc2c7be464e0ff6a0ff",
        "target":  {
            "file":  "client/src/main/java/org/asynchttpclient/netty/handler/intercept/Interceptors.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "262008857587229939276875489319346709946",
            "length":  2008
        },
        "id":  "CVE-2026-85717-e5f54550",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/asynchttpclient/async-http-client/commit/b66757bec34def2e9867bb2b77bd848b1112abb4",
        "target":  {
            "file":  "client/src/main/java/org/asynchttpclient/netty/handler/intercept/Interceptors.java",
            "function":  "exitAfterIntercept"
        }
    }
]
vanir_signatures_modified 
"2026-09-24T08:05:02Z"