Local File Overwrite Vulnerability in AsyncHttpClient Package
Summary
DEBIAN-CVE-2026-102740: The AsyncHttpClient library allows Java applications to execute HTTP requests and asynchronously process HTTP responses. Affects async-http-client versions 2.12.3-1 – 2.12.3-1+deb12u1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The AsyncHttpClient library is a popular tool used in Java applications for executing HTTP requests and processing HTTP responses asynchronously. It provides a flexible and efficient way to handle network communications, making it a preferred choice for developers. However, certain versions of this library have a vulnerability that can expose sensitive information and allow local users to manipulate files.
Vulnerability Detail
The vulnerability arises from the PropertiesBasedResumableProcessor, which stores resumable download states in a shared path with default permissions. This allows local users to read sensitive download URLs, including user information and query tokens. Additionally, if a local user can write to the shared store directory, they can create a symbolic link that the AsyncHttpClient will follow, potentially overwriting critical files. This issue affects versions 2.0.0 to 2.16.1 and 3.0.12, and it poses significant risks to data integrity and confidentiality.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can change the permissions of the shared store directory to restrict access to unauthorized users. This can be done using the following command: 'chmod 700 /path/to/shared/store/directory'. However, this does not fully mitigate the risk and should only be a short-term solution.
Conclusion
The AsyncHttpClient library has a significant vulnerability that can lead to local file overwrites and exposure of sensitive information. It is crucial for users to update to the latest patched versions to mitigate these risks. Temporary workarounds can be implemented, but they do not replace the need for a proper update.
See every vulnerability recorded for async-http-client →
FAQ
Versions from 2.0.0 to 2.16.1 and 3.0.12 are affected.
Sensitive information such as download URLs, user information, and query tokens can be exposed.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without any signup.
The CVSS score of this vulnerability is 5.8.
If an immediate update is not possible, consider implementing the suggested workaround to restrict access to the shared store directory.
References
Related vulnerabilities
Recent vulnerabilities recorded for async-http-client.
