CVE-2026-107231: AsyncHttpClient Digest authentication downgrade to Basic cleartext password

CVE-2026-107231 · Severity: high · CVSS 4 · Published 2026-10-08

AsyncHttpClient is a library that handles HTTP requests with authentication. When a server sends a malformed Digest authentication challenge without a usable nonce, the client incorrectly falls back to Basic authentication and sends the password in base64-encoded cleartext. An attacker who can intercept traffic or compromise a proxy can capture credentials and reuse them against other services.

Technologies: AsyncHttpClient. Vendors: AsyncHttpClient.

Quick answers

Is CVE-2026-107231 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-107231 being exploited in the wild.
How severe is CVE-2026-107231?
High severity, with a CVSS score of 4, published 8 October 2026.
Which products and versions are affected?
AsyncHttpClient 3.0.12 and earlier on 3.x line; 2.16.0 and earlier on 2.x line.
Is there a fix for CVE-2026-107231?
Yes: fixed in 3.0.13 (3.x line), 2.16.1 (2.x line). Until then: Do not use Digest authentication against servers you do not control, and do not use Digest authentication over plaintext HTTP until you can upgrade.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-08","note":"GHSA-rqf5-2wxv-rjf4 published"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-107231 attacked?
It is attacked over the network or from the adjacent network, in a software library.
Am I affected by CVE-2026-107231?
Check whether you run AsyncHttpClient at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: 3.0.13 (3.x line), 2.16.1 (2.x line)

Do not use Digest authentication against servers you do not control, and do not use Digest authentication over plaintext HTTP until you can upgrade.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-08","note":"GHSA-rqf5-2wxv-rjf4 published"}]

Technical details

The vulnerability exists in the parseWWWAuthenticateHeader and parseProxyAuthenticateHeader methods, which infer the authentication scheme based on whether a nonce is present rather than respecting the scheme declared in the challenge. A Digest challenge missing or with an empty nonce triggers a downgrade to Basic, allowing the password to be transmitted in recoverable base64 encoding over plaintext or compromised hops. The attacker must be positioned to write or modify the 401/407 response (malicious server, compromised proxy, or plaintext network path).

Affected products

  • AsyncHttpClient AsyncHttpClient 3.0.12 and earlier on 3.x line; 2.16.0 and earlier on 2.x line

Identifiers

  • CVE-2026-107231
  • GHSA-rqf5-2wxv-rjf4

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.