{"action":"Upgrade org.asynchttpclient:async-http-client to 2.16.1 (2.x) or 3.0.12 (3.x) or later.","affected":[{"fixed":"3.0.12","introduced":"3.0.0"},{"fixed":"2.16.1","introduced":"2.0.0"}],"component":"org.asynchttpclient:async-http-client","cve_ids":["CVE-2026-85721"],"ecosystem":"Maven","epss":0.0063,"exploited":false,"fixed_versions":["3.0.12","2.16.1"],"ghsa_id":"GHSA-7grg-jcf7-rpmx","id":"tcs_01M5N8JD6P1D5PF32WST07P3F4","modified_at":"2026-09-17T17:30:05.777050891Z","published_at":"2026-09-17T17:18:56Z","references":["https://osv.dev/vulnerability/GHSA-7grg-jcf7-rpmx","https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-7grg-jcf7-rpmx","https://github.com/AsyncHttpClient/async-http-client/commit/5ee2841cbf268bba4a200578be3938ccfc6cc6d6","https://github.com/AsyncHttpClient/async-http-client/commit/663a1a91757904b22cfe37e2e6049f1f8ea6ae59","https://github.com/AsyncHttpClient/async-http-client/commit/e1871a19972fb496be1b8ac6be11d79e22ff2162","https://github.com/AsyncHttpClient/async-http-client/commit/e9f2f7423e0f6503f529656f2955a1317e56ba14","https://github.com/AsyncHttpClient/async-http-client"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-7grg-jcf7-rpmx","url":"https://osv.dev/vulnerability/GHSA-7grg-jcf7-rpmx"}],"summary":"AsyncHttpClient's unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of service"}