org.asynchttpclient:async-http-client vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-107228Mediumorg.asynchttpclient:async-http-client: AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader (Bypass of CVE-2024-53990 Fix)CVE-2026-107226Mediumorg.asynchttpclient:async-http-client: AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPSCVE-2026-107227Highorg.asynchttpclient:async-http-client: AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is…CVE-2026-107230Highorg.asynchttpclient:async-http-client: AsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy loginsCVE-2026-107283Loworg.asynchttpclient:async-http-client: AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random sourceCVE-2026-107285Mediumorg.asynchttpclient:async-http-client: AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnelCVE-2026-107280Mediumorg.asynchttpclient:async-http-client: AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.ukCVE-2026-107282Criticalorg.asynchttpclient:async-http-client: AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new hostCVE-2026-107231Highorg.asynchttpclient:async-http-client: AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartextCVE-2026-85717Mediumorg.asynchttpclient:async-http-client: AsyncHttpClient re-sends client-wide realm credentials to a cross-origin redirect targetCVE-2026-85720Mediumorg.asynchttpclient:async-http-client: AsyncHttpClient sends origin credentials to the proxy on the plaintext CONNECT requestCVE-2026-85721Highorg.asynchttpclient:async-http-client: AsyncHttpClient's unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of serviceCVE-2026-85716Loworg.asynchttpclient:async-http-client: AsyncHttpClient doesn't verify SCRAM and Digest mutual-authentication responsesCVE-2026-55688Mediumorg.asynchttpclient:async-http-client: AsyncHttpClient stores cookie for an unrelated domain (cookie tossing) via ThreadSafeCookieStoreCVE-2026-45300Highorg.asynchttpclient:async-http-client: async-http-client: Cookie header not stripped on cross-origin redirectCVE-2026-40490Mediumorg.asynchttpclient:async-http-client: AsyncHttpClient leaks authorization credentials to untrusted domains on cross-origin redirectsCVE-2024-53990Criticalorg.asynchttpclient:async-http-client: AsyncHttpClient (AHC) library's `CookieStore` replaces explicitly defined `Cookie`sCVE-2017-14063Highorg.asynchttpclient:async-http-client: Improper Input Validation in async-http-client

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo