GHSA-3wp9-xfwm-rjjf CVE-2026-107285
AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel
- Severity
- 5.9 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- 0.21%
- Chance of exploitation in the next 30 days. Higher than 10.64% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-319 Cleartext Transmission of Sensitive Information
- CWE-522 Insufficiently Protected Credentials
- Fix
3.0.12- Upgrade org.asynchttpclient:async-http-client to this version or later
Description
Impact
When a ws:// request is routed through an HTTP proxy with proxy authentication configured, the client tunnels the connection with an HTTP CONNECT, the same as it does for https://. Once the tunnel is open, the WebSocket upgrade request that follows is sent through the tunnel directly to the origin server, not to the proxy. The proxy-auth gate and the companion request-target selection keyed only on whether the URI was secured, which is false for ws://, so the tunnelled upgrade request incorrectly carried the proxy's Proxy-Authorization header and an absolute-form request target meant for the proxy. Any origin server reached over a proxied ws:// connection, or anyone positioned on the origin side of the wire, could recover the proxy credentials: directly for Basic, or as a replayable and offline-crackable response for Digest.
Affected versions
- 3.x: up to and including 3.0.11
- 2.x: up to and including 2.16.0
Patches
Fixed in 3.0.12 on the 3.x line and in 2.16.1 on the 2.x line. The preemptive Proxy-Authorization header and the absolute-form request target are no longer attached to a tunnelled ws:// upgrade; a ws:// request is now treated like wss://.
Workarounds
Do not use proxy authentication together with ws:// requests through an HTTP proxy, or use wss:// instead.
Details
The proxy-auth gate in NettyRequestFactory#newNettyRequest and the sibling branch in requestUri() did not exclude WebSocket URIs, even though the CONNECT-tunnelling check in NettyRequestSender already tunnels ws:// through CONNECT exactly like https://.
Note that 3.0.12 is itself affected by a separate issue, GHSA-rqf5-2wxv-rjf4, where a Digest challenge the client cannot read downgrades to Basic and sends the password in cleartext. Upgrade to 3.0.13 to pick up both fixes.
Affected versions
Maven
| Package | Vulnerable | Fixed in |
|---|---|---|
| org.asynchttpclient:async-http-client | >= 3.0.0, < 3.0.12 |
3.0.12 |
| org.asynchttpclient:async-http-client | >= 2.0.0, < 2.16.1 |
2.16.1 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
org.asynchttpclient:async-http-client Maven → 3.0.12
- maven
<dependency><groupId>org.asynchttpclient</groupId><artifactId>async-http-client</artifactId><version>3.0.12</version></dependency>- gradle
implementation("org.asynchttpclient:async-http-client:3.0.12")
Severity breakdown
CVSS 3.1 5.9
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- Attack vector
- Network
- Attack complexity
- High
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Weakness
CWE-319: Cleartext Transmission of Sensitive Information
The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
How to prevent it
- Architecture and Design: Before transmitting, encrypt the data using reliable, confidentiality-protecting cryptographic protocols.
- Implementation: When using web applications with SSL, use SSL for the entire session from login to logout, not just for the initial login page.
- Implementation: When designing hardware platforms, ensure that approved encryption algorithms (such as those recommended by NIST) protect paths from security critical data to trusted user applications.
- Testing: Use tools and techniques that require manual (human) analysis, such as penetration testing, threat modeling, and interactive tools that allow the tester to record and modify an active session. These may be more effective than strictly automated techniques. This is especially the case with weaknesses that are related to design and business rules.
- Operation: Configure servers to use encrypted channels for communication, which may include SSL or other secure protocols.
CWE-522: Insufficiently Protected Credentials
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
How to prevent it
- Architecture and Design: Use an appropriate security mechanism to protect the credentials.
- Architecture and Design: Make appropriate use of cryptography to protect the credentials.
- Implementation: Use industry standards to protect the credentials (e.g. LDAP, keystore, etc.).
References
Advisories
Packages
Other links
- github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-3wp9-xfwm…
- github.com/AsyncHttpClient/async-http-client/commit/6e9cb75a9b7259353f983fc90ca…
- github.com/AsyncHttpClient/async-http-client/commit/c4feab0f7f86d61505a48e40d38…
- github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-pro…
- github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-pro…
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-p2jm-6hj6-9rjg AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPS | Medium | Also affects org.asynchttpclient:async-http-client |
| GHSA-mfj3-87qq-382v AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random source | Low | Also affects org.asynchttpclient:async-http-client |
| GHSA-jmqq-x5g9-9p2w AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host | Critical | Also affects org.asynchttpclient:async-http-client |
| GHSA-f9m8-cv68-674w AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.uk | Medium | Also affects org.asynchttpclient:async-http-client |
| GHSA-rqf5-2wxv-rjf4 AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext | High | Also affects org.asynchttpclient:async-http-client |
| GHSA-v2j5-22fr-j62r AsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy logins | High | Also affects org.asynchttpclient:async-http-client |
| GHSA-2jwh-9rmr-j4xf AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader (Bypass of CVE-2024-53990 Fix) | Medium | Also affects org.asynchttpclient:async-http-client |
| GHSA-x8v2-478q-2hvg AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabled | High | Also affects org.asynchttpclient:async-http-client |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor