Technology · AsyncHttpClient
AsyncHttpClient vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 15 vulnerabilities in AsyncHttpClient: 0 in the last 7 days and 13 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-102740, was published on 15 October 2026. 2 vulnerabilities in the last four weeks, down 82% on the four before (11).
- Last 7 days
- 0
- Last 90 days
- 13
- Critical, all time
- 0
- Exploited in the wild
- 0
About AsyncHttpClient
An asynchronous HTTP client library for Java built on top of Netty.
Latest AsyncHttpClient vulnerabilities
- CVE-2026-102740: AsyncHttpClient resumable download information disclosure and file tamperingmediumCVSS 5.8EPSS 0.1%
- CVE-2026-107226: AsyncHttpClient cookie security bypass in HTTPmediumCVSS 6.8EPSS 0.4%
- CVE-2026-107228: AsyncHttpClient CookieStore header override via setHeadermediumCVSS 6.8EPSS 0.3%
- CVE-2026-107227: AsyncHttpClient unbounded WebSocket decompression denial of servicehighCVSS 7.5EPSS 0.4%
- CVE-2026-107230: AsyncHttpClient pooled connection reuse across NTLM and Negotiate loginshighCVSS 7.4EPSS 0.2%
- CVE-2026-107285: AsyncHttpClient WebSocket proxy credentials sent to origin servermediumCVSS 5.9EPSS 0.2%
- CVE-2026-107280: AsyncHttpClient cookie domain validation bypass via public suffixmediumCVSS 4EPSS 0.3%
- CVE-2026-107231: AsyncHttpClient Digest authentication downgrade to Basic cleartext passwordhighCVSS 4EPSS 0.2%
- CVE-2026-85720: AsyncHttpClient credentials exposure in plaintext CONNECT proxy requestsmediumCVSS 5.9EPSS 0.3%
- CVE-2026-85716: AsyncHttpClient SCRAM and Digest mutual authentication verification bypasslowCVSS 3.7EPSS 0.4%
- CVE-2026-85721: AsyncHttpClient unbounded HTTP/1.1 response decompression denial of servicehighCVSS 7.5EPSS 0.6%
- CVE-2026-85719: AsyncHttpClient proxy credential disclosure over SOCKShighCVSS 7.5EPSS 0.4%
- CVE-2026-85717: AsyncHttpClient credential leak on cross-origin redirectmediumCVSS 6.8EPSS 0.5%
- CVE-2026-55688: AsyncHttpClient cookie injection in ThreadSafeCookieStoremediumCVSS 4EPSS 0.3%
- CVE-2026-45300: AsyncHttpClient sensitive information leak in Redirect30xInterceptorhighCVSS 7.4EPSS 0.5%
Most severe AsyncHttpClient vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-85721: AsyncHttpClient unbounded HTTP/1.1 response decompression denial of servicehighCVSS 7.5EPSS 0.6%
- CVE-2026-107227: AsyncHttpClient unbounded WebSocket decompression denial of servicehighCVSS 7.5EPSS 0.4%
- CVE-2026-85719: AsyncHttpClient proxy credential disclosure over SOCKShighCVSS 7.5EPSS 0.4%
- CVE-2026-45300: AsyncHttpClient sensitive information leak in Redirect30xInterceptorhighCVSS 7.4EPSS 0.5%
- CVE-2026-107230: AsyncHttpClient pooled connection reuse across NTLM and Negotiate loginshighCVSS 7.4EPSS 0.2%
- CVE-2026-107231: AsyncHttpClient Digest authentication downgrade to Basic cleartext passwordhighCVSS 4EPSS 0.2%
- CVE-2026-85717: AsyncHttpClient credential leak on cross-origin redirectmediumCVSS 6.8EPSS 0.5%
- CVE-2026-107226: AsyncHttpClient cookie security bypass in HTTPmediumCVSS 6.8EPSS 0.4%
- CVE-2026-107228: AsyncHttpClient CookieStore header override via setHeadermediumCVSS 6.8EPSS 0.3%
- CVE-2026-85720: AsyncHttpClient credentials exposure in plaintext CONNECT proxy requestsmediumCVSS 5.9EPSS 0.3%
Vulnerabilities per week
2 vulnerabilities in the last four weeks, down 82% on the four before (11). The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 5 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 6 | 0 | |
| 12 Oct 2026 | 2 | 0 | |
| 19 Oct 2026 | 0 | 0 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many AsyncHttpClient vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/asynchttpclient)<a href="https://junglewise.ai/threats/technologies/asynchttpclient"><img src="https://junglewise.ai/threats/technologies/asynchttpclient/badge.svg" alt="AsyncHttpClient vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/asynchttpclient.json, and this page as text at https://junglewise.ai/threats/technologies/asynchttpclient.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "AsyncHttpClient vulnerabilities", https://junglewise.ai/threats/technologies/asynchttpclient, 12 November 2026.