Executive brief
AsyncHttpClient, a library used by applications to make HTTP requests, sends authentication credentials in plaintext to HTTP proxies before establishing encryption. When an application accesses a secure website through an HTTP proxy, the library's earlier versions transmitted the origin server's login credentials unencrypted to the proxy, exposing sensitive authentication data to anyone monitoring the network between the client and proxy.
Technical details
The vulnerability is an information disclosure flaw in AsyncHttpClient's proxy handling. NettyRequestFactory and NettyRequestSender incorrectly attach origin credentials (Basic/Digest/NTLM/SPNEGO/Kerberos tokens) to the plaintext CONNECT request sent to establish the HTTPS tunnel, before TLS encryption is negotiated. An attacker with network access between the client and proxy can intercept these credentials. The fix removes origin authentication headers from the CONNECT itself; credentials are now added only to the tunneled request after the encrypted tunnel is established. Patches are available in version 3.0.12 (3.x line) and 2.16.1 (2.x line).
Affected products
- AsyncHttpClient AsyncHttpClient 2.x up to and including 2.16.0; 3.x up to and including 3.0.11
Timeline
- 2026-09-17: disclosed
- 2026-09-17: patched: Version 3.0.12 (3.x line) and 2.16.1 (2.x line)