Is CVE-2026-107285 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-107285 being exploited in the wild.

How severe is CVE-2026-107285?

Medium severity, with a CVSS score of 5.9, published 8 October 2026.

Which products and versions are affected?

AsyncHttpClient 2.x up to and including 2.16.0; 3.x up to and including 3.0.11.

How is CVE-2026-107285 attacked?

It is attacked over the network.

Am I affected by CVE-2026-107285?

Check whether you run AsyncHttpClient at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107285: AsyncHttpClient WebSocket proxy credentials sent to origin server

CVE-2026-107285 · Severity: medium · CVSS 5.9 · Published 2026-10-08

AsyncHttpClient is a library used by applications to make HTTP and WebSocket requests. When routing unencrypted WebSocket connections through an HTTP proxy with authentication, the library incorrectly exposes the proxy's login credentials to the origin server. An attacker controlling the WebSocket server, or positioned on the network path, can capture and use these credentials to access the proxy.

Technologies: AsyncHttpClient. Vendors: AsyncHttpClient.

Quick answers

Is CVE-2026-107285 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-107285 being exploited in the wild.
How severe is CVE-2026-107285?: Medium severity, with a CVSS score of 5.9, published 8 October 2026.
Which products and versions are affected?: AsyncHttpClient 2.x up to and including 2.16.0; 3.x up to and including 3.0.11.
Is there a fix for CVE-2026-107285?: Yes: fixed in 2.16.1, 3.0.12 (note: 3.0.12 has a separate issue; upgrade to 3.0.13). Until then: Do not use proxy authentication with ws:// requests through an HTTP proxy. Use wss:// (WebSocket Secure) instead, which is not affected by this issue. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-107285 attacked?: It is attacked over the network.
Am I affected by CVE-2026-107285?: Check whether you run AsyncHttpClient at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2.16.1, 3.0.12 (note: 3.0.12 has a separate issue; upgrade to 3.0.13)

Do not use proxy authentication with ws:// requests through an HTTP proxy. Use wss:// (WebSocket Secure) instead, which is not affected by this issue.

Technical details

The vulnerability lies in the proxy authentication gate in NettyRequestFactory#newNettyRequest and requestUri(), which fails to exclude WebSocket URIs (ws://) even though CONNECT tunnelling is used for them. Tunnelled ws:// upgrade requests carry the Proxy-Authorization header and absolute-form request target intended for the proxy, leaking credentials (cleartext for Basic auth, offline-crackable for Digest) to the origin server or network observers. This affects applications using AsyncHttpClient 2.x and 3.x when routing ws:// through authenticated HTTP proxies.

Affected products

AsyncHttpClient AsyncHttpClient 2.x up to and including 2.16.0; 3.x up to and including 3.0.11

Identifiers

CVE-2026-107285
GHSA-3wp9-xfwm-rjjf

Timeline

2026-10-08: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.