WebSocket Handshake Vulnerability in AsyncHttpClient Package
Summary
DEBIAN-CVE-2026-107284: The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Affects async-http-client versions 2.12.3-1 – 2.12.3-1+deb12u1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The AsyncHttpClient (AHC) library is a widely used tool in Java applications that simplifies the execution of HTTP requests and the asynchronous processing of HTTP responses. It is designed to handle high-performance web communication, making it a popular choice for developers. However, prior to versions 3.0.12 and 2.16.1, AHC had a critical vulnerability in its WebSocketHandler component, which could lead to security issues during WebSocket handshakes.
Vulnerability Detail
The vulnerability arises from the WebSocketHandler.upgrade method, which improperly handles handshakes with missing or invalid Sec-WebSocket-Accept values. Although the handshake is aborted, the process continues into pipeline installation and onOpen delivery, allowing frames coalesced with an invalid 101 response to be decoded and delivered from a peer that did not prove the handshake. This can lead to unauthorized access and potential data leakage, as the request future fails and the channel closes, but not before the invalid frames are processed.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to update to the patched versions as soon as possible.
Conclusion
The AsyncHttpClient library has a significant vulnerability related to WebSocket handshakes that could lead to unauthorized access and data leakage. It is crucial for users to update to the latest patched versions to mitigate these risks. Regular monitoring and vulnerability checks using tools like Vulert can further enhance security.
See every vulnerability recorded for async-http-client →
FAQ
The CVSS score of this vulnerability is 3.7, indicating a medium severity level.
Versions prior to 3.0.12 and 2.16.1 are affected by this vulnerability.
Failing to address this vulnerability may allow unauthorized access and data leakage through improperly handled WebSocket connections.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Vulert monitors and alerts in real-time for open-source vulnerabilities using just a manifest file like package-lock.json, providing an easy way to stay informed about potential security issues.
References
Related vulnerabilities
Recent vulnerabilities recorded for async-http-client.
