Executive brief
AsyncHttpClient is a Java library that applications use to send HTTP requests through proxy servers. When configured to use a SOCKS proxy with authentication, the library incorrectly exposes the proxy's login credentials to the destination web server instead of keeping them private to the proxy. An attacker running a malicious website could steal these credentials, potentially including reversible passwords or Kerberos tokens.
Technical details
The vulnerability is a credential leakage flaw in AsyncHttpClient versions 2.1.0–2.16.0 and 3.0.0–3.0.11. The root cause is that NettyRequestFactory and NettyRequestSender attach Proxy-Authorization headers without checking the proxy type; they assume HTTP proxies but fail to guard against SOCKS proxies. With preemptive authentication, Basic credentials are sent plaintext in HTTP requests to the origin. With non-preemptive flows, a hostile origin can return HTTP 407 responses, triggering ProxyUnauthorized407Interceptor to forward proxy credentials (including NTLM, Kerberos, SPNEGO) through the existing SOCKS tunnel to the origin. The fix, applied in versions 2.16.1 and 3.0.12, gates both credential-attach sinks on proxyServer.getProxyType().isHttp() to ensure credentials are only sent to HTTP(S) proxies.
Affected products
- AsyncHttpClient AsyncHttpClient 2.1.0 to 2.16.0, 3.0.0 to 3.0.11
Timeline
- 2026-09-17: disclosed
- 2026-08-08: patched: Fix committed; releases 2.16.1 and 3.0.12 contain the patch