# AsyncHttpClient vulnerabilities Source: https://junglewise.ai/threats/technologies/asynchttpclient Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/asynchttpclient.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 15 vulnerabilities in AsyncHttpClient: 0 in the last 7 days and 13 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-102740, was published on 15 October 2026. 2 vulnerabilities in the last four weeks, down 82% on the four before (11). ## Counts - Last 7 days: 0 - Last 30 days: 1 - Last 90 days: 13 - All time: 15 (0 critical, 0 exploited in the wild) ## About AsyncHttpClient An asynchronous HTTP client library for Java built on top of Netty. ## Latest AsyncHttpClient vulnerabilities - [CVE-2026-102740: AsyncHttpClient resumable download information disclosure and file tampering](https://junglewise.ai/threats/cve-2026-102740-the-asynchttpclient-library-allows-java-applications-to-execute) (medium, CVSS 5.8, published 15 Oct 2026) - [CVE-2026-107226: AsyncHttpClient cookie security bypass in HTTP](https://junglewise.ai/threats/cve-2026-107226-asynchttpclient-cookies-received-over-plaintext-http-can-plant) (medium, CVSS 6.8, published 12 Oct 2026) - [CVE-2026-107228: AsyncHttpClient CookieStore header override via setHeader](https://junglewise.ai/threats/cve-2026-107228-asynchttpclient-cookiestore-silently-overrides-caller-s-explicit) (medium, CVSS 6.8, published 8 Oct 2026) - [CVE-2026-107227: AsyncHttpClient unbounded WebSocket decompression denial of service](https://junglewise.ai/threats/cve-2026-107227-asynchttpclient-unbounded-websocket-permessage-deflate) (high, CVSS 7.5, published 8 Oct 2026) - [CVE-2026-107230: AsyncHttpClient pooled connection reuse across NTLM and Negotiate logins](https://junglewise.ai/threats/cve-2026-107230-asynchttpclient-pooled-connections-can-still-be-shared-across) (high, CVSS 7.4, published 8 Oct 2026) - [CVE-2026-107285: AsyncHttpClient WebSocket proxy credentials sent to origin server](https://junglewise.ai/threats/cve-2026-107285-asynchttpclient-websocket-proxy-credentials-sent-to-the-origin) (medium, CVSS 5.9, published 8 Oct 2026) - [CVE-2026-107280: AsyncHttpClient cookie domain validation bypass via public suffix](https://junglewise.ai/threats/cve-2026-107280-asynchttpclient-cookie-domain-attribute-is-not-checked-against) (medium, CVSS 4, published 8 Oct 2026) - [CVE-2026-107231: AsyncHttpClient Digest authentication downgrade to Basic cleartext password](https://junglewise.ai/threats/cve-2026-107231-asynchttpclient-digest-challenge-without-a-usable-nonce) (high, CVSS 4, published 8 Oct 2026) - [CVE-2026-85720: AsyncHttpClient credentials exposure in plaintext CONNECT proxy requests](https://junglewise.ai/threats/cve-2026-85720-asynchttpclient-credentials-exposure-in-plaintext-connect-proxy) (medium, CVSS 5.9, published 17 Sep 2026) - [CVE-2026-85716: AsyncHttpClient SCRAM and Digest mutual authentication verification bypass](https://junglewise.ai/threats/cve-2026-85716-asynchttpclient-scram-and-digest-mutual-authentication) (low, CVSS 3.7, published 17 Sep 2026) - [CVE-2026-85721: AsyncHttpClient unbounded HTTP/1.1 response decompression denial of service](https://junglewise.ai/threats/cve-2026-85721-asynchttpclient-unbounded-http-1-1-response-decompression-denial) (high, CVSS 7.5, published 17 Sep 2026) - [CVE-2026-85719: AsyncHttpClient proxy credential disclosure over SOCKS](https://junglewise.ai/threats/cve-2026-85719-asynchttpclient-proxy-credential-disclosure-over-socks) (high, CVSS 7.5, published 17 Sep 2026) - [CVE-2026-85717: AsyncHttpClient credential leak on cross-origin redirect](https://junglewise.ai/threats/cve-2026-85717-asynchttpclient-credential-leak-on-cross-origin-redirect) (medium, CVSS 6.8, published 17 Sep 2026) - [CVE-2026-55688: AsyncHttpClient cookie injection in ThreadSafeCookieStore](https://junglewise.ai/threats/cve-2026-55688-asynchttpclient-cookie-injection-in-threadsafecookiestore) (medium, CVSS 4, published 1 Jul 2026) - [CVE-2026-45300: AsyncHttpClient sensitive information leak in Redirect30xInterceptor](https://junglewise.ai/threats/cve-2026-45300-asynchttpclient-sensitive-information-leak-in) (high, CVSS 7.4, published 5 Jun 2026) ## Most severe AsyncHttpClient vulnerabilities - [CVE-2026-85721: AsyncHttpClient unbounded HTTP/1.1 response decompression denial of service](https://junglewise.ai/threats/cve-2026-85721-asynchttpclient-unbounded-http-1-1-response-decompression-denial) (high, CVSS 7.5, published 17 Sep 2026) - [CVE-2026-107227: AsyncHttpClient unbounded WebSocket decompression denial of service](https://junglewise.ai/threats/cve-2026-107227-asynchttpclient-unbounded-websocket-permessage-deflate) (high, CVSS 7.5, published 8 Oct 2026) - [CVE-2026-85719: AsyncHttpClient proxy credential disclosure over SOCKS](https://junglewise.ai/threats/cve-2026-85719-asynchttpclient-proxy-credential-disclosure-over-socks) (high, CVSS 7.5, published 17 Sep 2026) - [CVE-2026-45300: AsyncHttpClient sensitive information leak in Redirect30xInterceptor](https://junglewise.ai/threats/cve-2026-45300-asynchttpclient-sensitive-information-leak-in) (high, CVSS 7.4, published 5 Jun 2026) - [CVE-2026-107230: AsyncHttpClient pooled connection reuse across NTLM and Negotiate logins](https://junglewise.ai/threats/cve-2026-107230-asynchttpclient-pooled-connections-can-still-be-shared-across) (high, CVSS 7.4, published 8 Oct 2026) - [CVE-2026-107231: AsyncHttpClient Digest authentication downgrade to Basic cleartext password](https://junglewise.ai/threats/cve-2026-107231-asynchttpclient-digest-challenge-without-a-usable-nonce) (high, CVSS 4, published 8 Oct 2026) - [CVE-2026-85717: AsyncHttpClient credential leak on cross-origin redirect](https://junglewise.ai/threats/cve-2026-85717-asynchttpclient-credential-leak-on-cross-origin-redirect) (medium, CVSS 6.8, published 17 Sep 2026) - [CVE-2026-107226: AsyncHttpClient cookie security bypass in HTTP](https://junglewise.ai/threats/cve-2026-107226-asynchttpclient-cookies-received-over-plaintext-http-can-plant) (medium, CVSS 6.8, published 12 Oct 2026) - [CVE-2026-107228: AsyncHttpClient CookieStore header override via setHeader](https://junglewise.ai/threats/cve-2026-107228-asynchttpclient-cookiestore-silently-overrides-caller-s-explicit) (medium, CVSS 6.8, published 8 Oct 2026) - [CVE-2026-85720: AsyncHttpClient credentials exposure in plaintext CONNECT proxy requests](https://junglewise.ai/threats/cve-2026-85720-asynchttpclient-credentials-exposure-in-plaintext-connect-proxy) (medium, CVSS 5.9, published 17 Sep 2026) ## Vulnerabilities per week 2 vulnerabilities in the last four weeks, down 82% on the four before (11). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 5 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 6 | 0 | 0 | | 12 Oct 2026 | 2 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "AsyncHttpClient vulnerabilities", https://junglewise.ai/threats/technologies/asynchttpclient, 12 November 2026.