{"action":"Upgrade org.asynchttpclient:async-http-client to 2.16.1 (2.x) or 3.0.13 (3.x) or later.","affected":[{"fixed":"3.0.13","introduced":"3.0.0.Beta1"},{"fixed":"2.16.1","introduced":"2.0.0"}],"component":"org.asynchttpclient:async-http-client","cve_ids":["CVE-2026-107231"],"ecosystem":"Maven","epss":0.00237,"exploited":false,"fixed_versions":["3.0.13","2.16.1"],"ghsa_id":"GHSA-rqf5-2wxv-rjf4","id":"tcs_01M5N9CAQAEJT5W685MQCNX6G7","modified_at":"2026-10-08T16:30:05.838785912Z","published_at":"2026-10-08T16:23:36Z","references":["https://osv.dev/vulnerability/GHSA-rqf5-2wxv-rjf4","https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-rqf5-2wxv-rjf4","https://nvd.nist.gov/vuln/detail/CVE-2026-107231","https://github.com/AsyncHttpClient/async-http-client/commit/8376866aa9b5a7653ad19db9d472692f875caa83","https://github.com/AsyncHttpClient/async-http-client/commit/c8d639bf6ac341d377d610a93570bcd15565f1a6","https://github.com/AsyncHttpClient/async-http-client","https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-2.16.1","https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.13"],"severity":{"label":"high","score":8.7},"sources":[{"source":"osv","source_id":"GHSA-rqf5-2wxv-rjf4","url":"https://osv.dev/vulnerability/GHSA-rqf5-2wxv-rjf4"},{"source":"nvd","source_id":"CVE-2026-107231","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107231"}],"summary":"AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext"}