# CVE-2026-107282: AsyncHttpClient cross-host replay sends credentials to wrong host

Source: https://junglewise.ai/threats/cve-2026-107282-asynchttpclient-replay-to-a-different-host-sends-the-original  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-08. Updated: 2026-10-08  
License: CC BY 4.0 with a link back

CVE-2026-107282 · Severity: critical · CVSS 4 · Published 2026-10-08

AsyncHttpClient is a widely-used library for making HTTP requests in Java applications. When the client retries or failovers a request to a different server, it incorrectly sends the original server's authentication credentials and request details to the new server. An attacker who can trigger such a failover—or a legitimate failover mechanism in the application itself—can intercept authentication tokens and sensitive request data intended for one server.

Vendors: [Sonatype](https://junglewise.ai/threats/vendors/sonatype).

## Quick answers

**Is CVE-2026-107282 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-107282 being exploited in the wild.

**How severe is CVE-2026-107282?** Critical severity, with a CVSS score of 4, published 8 October 2026.

**Which products and versions are affected?** Sonatype AsyncHttpClient 2.x up to 2.16.0; 3.x up to 3.0.12.

**Is there a fix for CVE-2026-107282?** Yes: fixed in 3.0.13, 2.16.1. Until then: Do not use ResponseFilter logic that replays requests to different hosts, and disable request retries if the client is configured with credentials or used through a proxy. Replaying to the same host is unaffected. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-107282 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-107282?** Check whether you run Sonatype AsyncHttpClient at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 3.0.13, 2.16.1

Do not use ResponseFilter logic that replays requests to different hosts, and disable request retries if the client is configured with credentials or used through a proxy. Replaying to the same host is unaffected.

## Technical details

The vulnerability occurs when a request is replayed to a different host via ResponseFilter failover or IOException retry logic. The client updates the current request but leaves the target request and proxy configuration unchanged, causing multiple code paths (connection pool key derivation, CONNECT tunnel handling, realm selection, and SSL handler setup) to read stale host information and send the original request, credentials, and/or use incorrect encryption settings to the wrong destination. This is a long-standing behavior affecting both the 2.x and 3.x branches equally.

## Affected products

- Sonatype AsyncHttpClient 2.x up to 2.16.0; 3.x up to 3.0.12

## Identifiers

- CVE-2026-107282
- GHSA-jmqq-x5g9-9p2w

## Timeline

- 2026-10-08: disclosed