{"action":"Upgrade org.asynchttpclient:async-http-client to 3.0.12 or later.","affected":[{"fixed":"3.0.12","introduced":"3.0.8"}],"component":"org.asynchttpclient:async-http-client","cve_ids":["CVE-2026-85716"],"ecosystem":"Maven","epss":0.00409,"exploited":false,"fixed_versions":["3.0.12"],"ghsa_id":"GHSA-fj9w-c36g-h5x8","id":"tcs_01M5N8W55BGK5GR9G2VPHDJVNX","modified_at":"2026-09-17T17:30:07.552298086Z","published_at":"2026-09-17T17:18:39Z","references":["https://osv.dev/vulnerability/GHSA-fj9w-c36g-h5x8","https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-fj9w-c36g-h5x8","https://github.com/AsyncHttpClient/async-http-client/pull/2235","https://github.com/AsyncHttpClient/async-http-client/commit/10b3db9910f0bbad2ea3dc7c7553bae12bc4a5e4","https://github.com/AsyncHttpClient/async-http-client/commit/685173afea07892462071d966ef6ce5c88cbc66f","https://github.com/AsyncHttpClient/async-http-client/commit/7fe8700fd5b46c668cee7774624f36b87b9dd32a","https://github.com/AsyncHttpClient/async-http-client"],"severity":{"label":"low","score":3.7},"sources":[{"source":"osv","source_id":"GHSA-fj9w-c36g-h5x8","url":"https://osv.dev/vulnerability/GHSA-fj9w-c36g-h5x8"}],"summary":"AsyncHttpClient doesn't verify SCRAM and Digest mutual-authentication responses"}