{"action":"Upgrade org.asynchttpclient:async-http-client to 3.0.14 or later.","affected":[{"fixed":"3.0.14","introduced":"3.0.0"},{"introduced":"2.0.0","last_affected":"2.16.1"}],"component":"org.asynchttpclient:async-http-client","cve_ids":["CVE-2026-107230"],"ecosystem":"Maven","epss":0.00188,"exploited":false,"fixed_versions":["3.0.14"],"ghsa_id":"GHSA-v2j5-22fr-j62r","id":"tcs_01M5N9CYMS4H4D0H0D94VX0D3E","modified_at":"2026-10-08T17:01:03.329024369Z","published_at":"2026-10-08T16:49:46Z","references":["https://osv.dev/vulnerability/GHSA-v2j5-22fr-j62r","https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-v2j5-22fr-j62r","https://nvd.nist.gov/vuln/detail/CVE-2026-107230","https://github.com/AsyncHttpClient/async-http-client/commit/d3bb4d68b41acf5d3ab7541afa9fdfe7ec3ba054","https://github.com/AsyncHttpClient/async-http-client","https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.14"],"severity":{"label":"high","score":7.4},"sources":[{"source":"osv","source_id":"GHSA-v2j5-22fr-j62r","url":"https://osv.dev/vulnerability/GHSA-v2j5-22fr-j62r"}],"summary":"AsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy logins"}