Executive brief
AsyncHttpClient is a widely-used Java library for executing HTTP requests. When configured with limited connections per host, a TLS handshake failure can leak a connection permit, causing repeated failures to permanently block access to that host even after the connection closes. This can degrade service availability for applications relying on this library.
Technical details
The vulnerability is a resource leak in the connection permit handoff between request futures and channel close listeners. When a TLS connection establishment fails before the handshake completes, NettyConnectListener removes the partition lock permit from NettyResponseFuture before binding the cleanup handler to the channel's closeFuture. Under a race condition between timeout expiry and successful connection, an abort can leave the permit unreleased. Repeated failures can permanently exhaust the per-host or global connection pool. The default unlimited connection setting is not affected. The issue affects versions 3.0.8 through 3.0.11 and is fixed in 3.0.12.
Affected products
- AsyncHttpClient async-http-client 3.0.8 to 3.0.11
Timeline
- 2026-09-17: disclosed: CVE-2026-85718 published
- 2026-07-25: patched: Fix committed to main branch
- 2026-03-17: other: Initial issue #2189 reported