CVE-2026-85716
1 advisory.
Maven/org.asynchttpclient:async-http-client CVE-2026-85716: low 3.7
AsyncHttpClient doesn't verify SCRAM and Digest mutual-authentication responses
Action: Upgrade org.asynchttpclient:async-http-client to 3.0.12 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 3.0.8 | 3.0.12 | - |
Fixed versions
| 3.0.12 |
Sources
- osv: GHSA-fj9w-c36g-h5x8
- https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-fj9w-c36g-h5x8
- https://github.com/AsyncHttpClient/async-http-client/pull/2235
- https://github.com/AsyncHttpClient/async-http-client/commit/10b3db9910f0bbad2ea3dc7c7553bae12bc4a5e4
- https://github.com/AsyncHttpClient/async-http-client/commit/685173afea07892462071d966ef6ce5c88cbc66f
- https://github.com/AsyncHttpClient/async-http-client/commit/7fe8700fd5b46c668cee7774624f36b87b9dd32a
- https://github.com/AsyncHttpClient/async-http-client
CVE-2026-85716 · published · modified · JSON