{"action":"Upgrade org.asynchttpclient:async-http-client to 2.16.1 (2.x) or 3.0.13 (3.x) or later.","affected":[{"fixed":"3.0.13","introduced":"3.0.0"},{"fixed":"2.16.1","introduced":"2.0.0"}],"component":"org.asynchttpclient:async-http-client","cve_ids":["CVE-2026-107282"],"ecosystem":"Maven","epss":0.00189,"exploited":false,"fixed_versions":["3.0.13","2.16.1"],"ghsa_id":"GHSA-jmqq-x5g9-9p2w","id":"tcs_01M5N938BV744R41ZSAEC3H9SY","modified_at":"2026-10-08T16:45:19.474250752Z","published_at":"2026-10-08T16:30:46Z","references":["https://osv.dev/vulnerability/GHSA-jmqq-x5g9-9p2w","https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-jmqq-x5g9-9p2w","https://nvd.nist.gov/vuln/detail/CVE-2026-107282","https://github.com/AsyncHttpClient/async-http-client/commit/15b254514a411623e5f1d8c99ea79c0f82f8a466","https://github.com/AsyncHttpClient/async-http-client/commit/bbc31aed3b044f9f7a126cf689a8c8d7ad2ae1cb","https://github.com/AsyncHttpClient/async-http-client","https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-2.16.1","https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.13"],"severity":{"label":"critical","score":9.4},"sources":[{"source":"osv","source_id":"GHSA-jmqq-x5g9-9p2w","url":"https://osv.dev/vulnerability/GHSA-jmqq-x5g9-9p2w"},{"source":"nvd","source_id":"CVE-2026-107282","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107282"}],"summary":"AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host"}