CVE-2026-85720: AsyncHttpClient credentials exposure in plaintext CONNECT proxy requests

CVE-2026-85720 · Severity: medium · CVSS 5.9 · Published 2026-09-17

AsyncHttpClient, a library used by applications to make HTTP requests, sends authentication credentials in plaintext to HTTP proxies before establishing encryption. When an application accesses a secure website through an HTTP proxy, the library's earlier versions transmitted the origin server's login credentials unencrypted to the proxy, exposing sensitive authentication data to anyone monitoring the network between the client and proxy.

Technologies: AsyncHttpClient, org.asynchttpclient:async-http-client (Maven). Vendors: AsyncHttpClient, Maven.

Quick answers

Is CVE-2026-85720 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-85720 being exploited in the wild.
How severe is CVE-2026-85720?
Medium severity, with a CVSS score of 5.9, published 17 September 2026.
Which products and versions are affected?
AsyncHttpClient 2.x up to and including 2.16.0; 3.x up to and including 3.0.11; org.asynchttpclient:async-http-client (Maven) ECOSYSTEM:introduced=3.0.0,fixed=3.0.12.
Is there a fix for CVE-2026-85720?
Yes. org.asynchttpclient:async-http-client (Maven): upgrade to 3.0.12 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-85720 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-85720?
Check whether you run AsyncHttpClient or org.asynchttpclient:async-http-client (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.asynchttpclient:async-http-client (Maven): upgrade to 3.0.12 or later
    # set org.asynchttpclient:async-http-client to 3.0.12 in your pom.xml or build.gradle

Technical details

The vulnerability is an information disclosure flaw in AsyncHttpClient's proxy handling. NettyRequestFactory and NettyRequestSender incorrectly attach origin credentials (Basic/Digest/NTLM/SPNEGO/Kerberos tokens) to the plaintext CONNECT request sent to establish the HTTPS tunnel, before TLS encryption is negotiated. An attacker with network access between the client and proxy can intercept these credentials. The fix removes origin authentication headers from the CONNECT itself; credentials are now added only to the tunneled request after the encrypted tunnel is established. Patches are available in version 3.0.12 (3.x line) and 2.16.1 (2.x line).

Affected products

  • AsyncHttpClient AsyncHttpClient 2.x up to and including 2.16.0; 3.x up to and including 3.0.11

Identifiers

  • CVE-2026-85720
  • GHSA-xr57-gcx8-52hf

Timeline

  • 2026-09-17: disclosed
  • 2026-09-17: patched: Version 3.0.12 (3.x line) and 2.16.1 (2.x line)

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.