Is CVE-2026-85719 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-85719 being exploited in the wild.

How severe is CVE-2026-85719?

High severity, with a CVSS score of 7.5, published 17 September 2026.

Which products and versions are affected?

AsyncHttpClient 2.1.0 to 2.16.0, 3.0.0 to 3.0.11.

Is there a fix for CVE-2026-85719?

A patch was published on 2026-08-08: Fix committed; releases 2.16.1 and 3.0.12 contain the patch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-85719 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-85719?

Check whether you run AsyncHttpClient at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-85719: AsyncHttpClient proxy credential disclosure over SOCKS

CVE-2026-85719 · Severity: high · CVSS 7.5 · Published 2026-09-17

AsyncHttpClient is a Java library that applications use to send HTTP requests through proxy servers. When configured to use a SOCKS proxy with authentication, the library incorrectly exposes the proxy's login credentials to the destination web server instead of keeping them private to the proxy. An attacker running a malicious website could steal these credentials, potentially including reversible passwords or Kerberos tokens.

Technologies: AsyncHttpClient. Vendors: AsyncHttpClient.

Quick answers

Is CVE-2026-85719 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-85719 being exploited in the wild.
How severe is CVE-2026-85719?: High severity, with a CVSS score of 7.5, published 17 September 2026.
Which products and versions are affected?: AsyncHttpClient 2.1.0 to 2.16.0, 3.0.0 to 3.0.11.
Is there a fix for CVE-2026-85719?: A patch was published on 2026-08-08: Fix committed; releases 2.16.1 and 3.0.12 contain the patch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-85719 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-85719?: Check whether you run AsyncHttpClient at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a credential leakage flaw in AsyncHttpClient versions 2.1.0–2.16.0 and 3.0.0–3.0.11. The root cause is that NettyRequestFactory and NettyRequestSender attach Proxy-Authorization headers without checking the proxy type; they assume HTTP proxies but fail to guard against SOCKS proxies. With preemptive authentication, Basic credentials are sent plaintext in HTTP requests to the origin. With non-preemptive flows, a hostile origin can return HTTP 407 responses, triggering ProxyUnauthorized407Interceptor to forward proxy credentials (including NTLM, Kerberos, SPNEGO) through the existing SOCKS tunnel to the origin. The fix, applied in versions 2.16.1 and 3.0.12, gates both credential-attach sinks on proxyServer.getProxyType().isHttp() to ensure credentials are only sent to HTTP(S) proxies.

Affected products

AsyncHttpClient AsyncHttpClient 2.1.0 to 2.16.0, 3.0.0 to 3.0.11

Timeline

2026-09-17: disclosed
2026-08-08: patched: Fix committed; releases 2.16.1 and 3.0.12 contain the patch

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.