CVE-2026-85717: AsyncHttpClient credential leak on cross-origin redirect

CVE-2026-85717 · Severity: medium · CVSS 6.8 · Published 2026-09-17

AsyncHttpClient is a popular HTTP client library used in Java applications to make network requests. When configured with credentials at the application level and following redirects, the client could accidentally send authentication credentials (usernames, passwords, or tokens) to a malicious attacker-controlled website during a redirect. This allows an attacker to steal credentials intended for legitimate services.

Technologies: AsyncHttpClient, org.asynchttpclient:async-http-client (Maven). Vendors: AsyncHttpClient, Maven.

Quick answers

Is CVE-2026-85717 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-85717 being exploited in the wild.
How severe is CVE-2026-85717?
Medium severity, with a CVSS score of 6.8, published 17 September 2026.
Which products and versions are affected?
AsyncHttpClient 2.14.5 through 2.16.0, 3.0.9 through 3.0.11; org.asynchttpclient:async-http-client (Maven) ECOSYSTEM:introduced=3.0.9,fixed=3.0.12.
Is there a fix for CVE-2026-85717?
Yes. org.asynchttpclient:async-http-client (Maven): upgrade to 3.0.12 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-85717 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-85717?
Check whether you run AsyncHttpClient or org.asynchttpclient:async-http-client (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.asynchttpclient:async-http-client (Maven): upgrade to 3.0.12 or later
    # set org.asynchttpclient:async-http-client to 3.0.12 in your pom.xml or build.gradle

Technical details

The vulnerability is a credential re-derivation flaw in AsyncHttpClient's redirect handling. When processing a cross-origin redirect after receiving a 401 response, the client was re-reading credentials from the client-wide realm configuration instead of from the per-request state that had already been cleared during the redirect. This occurs only when credentials are configured globally on the client builder rather than per-request, and only when following redirects. An attacker controlling a redirect target can capture Basic/Digest credentials or Negotiate/NTLM tokens by triggering a 401 response. The fix (3.0.12 and 2.16.1) reads the realm from the per-request response state instead of re-deriving it from client configuration.

Affected products

  • AsyncHttpClient AsyncHttpClient 2.14.5 through 2.16.0, 3.0.9 through 3.0.11

Identifiers

  • CVE-2026-85717
  • GHSA-f8m2-889x-vw4x

Timeline

  • 2026-09-17: disclosed
  • 2026-09-17: patched: Fixed in 3.0.12 and 2.16.1

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.