{"action":"Upgrade org.asynchttpclient:async-http-client to 2.16.1 (2.x) or 3.0.12 (3.x) or later.","affected":[{"fixed":"3.0.12","introduced":"3.0.0"},{"fixed":"2.16.1","introduced":"2.0.0"}],"component":"org.asynchttpclient:async-http-client","cve_ids":["CVE-2026-85720"],"ecosystem":"Maven","epss":0.00265,"exploited":false,"fixed_versions":["3.0.12","2.16.1"],"ghsa_id":"GHSA-xr57-gcx8-52hf","id":"tcs_01M5N9JVX4N8M5ERNG4X8ZRMGD","modified_at":"2026-09-17T17:30:05.749737421Z","published_at":"2026-09-17T17:19:12Z","references":["https://osv.dev/vulnerability/GHSA-xr57-gcx8-52hf","https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-xr57-gcx8-52hf","https://github.com/AsyncHttpClient/async-http-client/pull/2234","https://github.com/AsyncHttpClient/async-http-client/commit/9dba5ac988b7e750551f59b2eab550b60ac8a0d6","https://github.com/AsyncHttpClient/async-http-client"],"severity":{"label":"medium","score":5.9},"sources":[{"source":"osv","source_id":"GHSA-xr57-gcx8-52hf","url":"https://osv.dev/vulnerability/GHSA-xr57-gcx8-52hf"}],"summary":"AsyncHttpClient sends origin credentials to the proxy on the plaintext CONNECT request"}