CVE-2026-85721

Maven/org.asynchttpclient:async-http-client CVE-2026-85721: high 7.5

AsyncHttpClient's unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of service

Action: Upgrade org.asynchttpclient:async-http-client to 2.16.1 (2.x) or 3.0.12 (3.x) or later.

Affected

Fixed versions

Sources

• osv: GHSA-7grg-jcf7-rpmx
• https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-7grg-jcf7-rpmx
• https://github.com/AsyncHttpClient/async-http-client/commit/5ee2841cbf268bba4a200578be3938ccfc6cc6d6
• https://github.com/AsyncHttpClient/async-http-client/commit/663a1a91757904b22cfe37e2e6049f1f8ea6ae59
• https://github.com/AsyncHttpClient/async-http-client/commit/e1871a19972fb496be1b8ac6be11d79e22ff2162
• https://github.com/AsyncHttpClient/async-http-client/commit/e9f2f7423e0f6503f529656f2955a1317e56ba14
• https://github.com/AsyncHttpClient/async-http-client

CVE-2026-85721 · published 2026-09-17T17:18:56Z · modified 2026-09-17T17:30:05.777050891Z · JSON