CVE-2026-107282: AsyncHttpClient Replay Vulnerability Exposing Credentials to Different Hosts
Summary
CVE-2026-107282: Impact When a request is replayed onto a different host, the client updates only the current request and leaves the target request pointing at the original host. Affects org.asynchttpclient:async-http-client across 2 version ranges.
>= 2.0.0, < 2.16.1
>= 3.0.0, < 3.0.13
Fixed in 2.16.1 or 3.0.13, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
AsyncHttpClient is a popular open-source library used for asynchronous HTTP requests in Java applications. It is designed to provide high performance and scalability, allowing developers to handle multiple requests concurrently. However, a critical vulnerability has been identified that allows an attacker to exploit the library's failover mechanism, potentially exposing sensitive credentials when requests are replayed to different hosts.
Vulnerability Detail
The vulnerability arises when a request is replayed to a different host without updating the target request. This results in the original host's request and credentials being sent to the new host. The issue is triggered through standard features like ResponseFilters and IOException retries. Attackers do not need to induce the replay; it can occur naturally in applications using failover. The vulnerability affects both HTTP and HTTPS requests, as the original request's details, including the Authorization header, are sent to the unintended host, leading to unauthorized access and data exposure.
How To Fix
Latest published version: 3.0.14 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.0.0, < 2.16.12.16.1 -
>= 3.0.0, < 3.0.133.0.13
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid using a ResponseFilter that replays requests to a different host. Additionally, disable request retries if the client is configured with credentials or used through a proxy. Replaying requests to the same host is not affected by this vulnerability.
Conclusion
The AsyncHttpClient vulnerability CVE-2026-107282 poses a significant risk by allowing the replay of requests to different hosts, potentially exposing sensitive credentials. It is crucial to update to the patched versions or implement the recommended workarounds to mitigate this risk.
See every vulnerability recorded for org.asynchttpclient:async-http-client →
FAQ
The CVSS score of this vulnerability is 9.4, indicating a critical level of severity.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The affected versions are 3.x up to and including 3.0.12 and 2.x up to and including 2.16.0.
If not fixed, this vulnerability can lead to unauthorized access to sensitive data as credentials may be sent to unintended hosts.
Yes, the vulnerability has been fixed in versions 3.0.13 and 2.16.1 of AsyncHttpClient.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.asynchttpclient:async-http-client.
