CVE-2013-7397: Insufficient Verification of Data Authenticity in Async Http Client
Summary
CVE-2013-7397: Insufficient Verification of Data Authenticity in Async Http Client. Affects com.ning:async-http-client versions < 1.9.0. Fixed in 1.9.0. How to fix ↓
Also tracked for
- async-http-client · Debian:11
The same CVE-2013-7397 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Async Http Client (aka AHC or async-http-client) is a popular Java library used for making asynchronous HTTP requests. It provides a simple and efficient way to perform HTTP operations in a non-blocking manner. AHC is commonly used in various applications and frameworks to handle HTTP communication. However, prior to version 1.9.0, AHC had a vulnerability that allowed man-in-the-middle attackers to spoof HTTPS servers by presenting an arbitrary certificate during use of a typical AHC configuration. This vulnerability occurred when a keyStore location and a trustStore location were not explicitly set, leading to insufficient X.509 certificate verification.
Vulnerability Detail
The vulnerability in Async Http Client (AHC) allowed attackers to perform man-in-the-middle attacks by presenting a fake certificate during HTTPS communication. This occurred when AHC was configured without explicitly setting the keyStore and trustStore locations. As a result, AHC would skip X.509 certificate verification, making it susceptible to spoofing attacks. An attacker could intercept the communication between the client and server, present a fake certificate, and potentially gain unauthorized access to sensitive information or modify the data exchanged between the client and server.
How To Fix
Latest published version: 1.9.40 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.9.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to version 1.9.0 or later of Async Http Client is not immediately feasible, a workaround is to explicitly set the keyStore and trustStore locations in the AHC configuration. By providing valid keyStore and trustStore locations, AHC will perform X.509 certificate verification even in earlier versions. Here is an example of how to set the keyStore and trustStore locations in the AHC configuration:
AsyncHttpClientConfig config = new DefaultAsyncHttpClientConfig.Builder()
.setKeyStorePath("/path/to/keystore")
.setTrustStorePath("/path/to/truststore")
.build();
AsyncHttpClient client = new DefaultAsyncHttpClient(config);
By explicitly setting the keyStore and trustStore locations, AHC will verify the authenticity of the server certificates, mitigating the risk of man-in-the-middle attacks.
Conclusion
The vulnerability in Async Http Client (AHC) allowed man-in-the-middle attacks by skipping X.509 certificate verification when the keyStore and trustStore locations were not explicitly set. To mitigate this vulnerability, it is recommended to upgrade to version 1.9.0 or later of AHC. Alternatively, you can set the keyStore and trustStore locations in the AHC configuration. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.ning:async-http-client →
FAQ
Async Http Client (AHC) is a Java library used for making asynchronous HTTP requests. It allows applications to perform HTTP operations in a non-blocking manner, improving performance and scalability.
The vulnerability in AHC allows man-in-the-middle attackers to spoof HTTPS servers, potentially leading to unauthorized access to sensitive information or modification of data exchanged between the client and server.
To fix this vulnerability, it is recommended to upgrade to version 1.9.0 or later of Async Http Client. Alternatively, you can explicitly set the keyStore and trustStore locations in the AHC configuration.
Yes, a workaround is to explicitly set the keyStore and trustStore locations in the AHC configuration. By providing valid keyStore and trustStore locations, AHC will perform X.509 certificate verification even in earlier versions.
You can find more information about Async Http Client on the official GitHub repository: https://github.com/AsyncHttpClient/async-http-client
References
Related vulnerabilities
Recent vulnerabilities recorded for com.ning:async-http-client.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.