org.asynchttpclient:async-http-client (Maven)
Advisories
34
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 3.0.14 or later clears every advisory below that has a fix.
Upgrade commands
maven
<dependency><groupId>org.asynchttpclient</groupId><artifactId>async-http-client</artifactId><version>3.0.14</version></dependency>gradle
implementation("org.asynchttpclient:async-http-client:3.0.14")Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-p2jm-6hj6-9rjg AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPS |
Medium EPSS 0.29% |
>= 3.0.0, < 3.0.14 | 3.0.14 |
| GHSA-p2jm-6hj6-9rjg AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPS |
Medium EPSS 0.29% |
>= 2.1.0, <= 2.16.1 | No fix yet |
| GHSA-3wp9-xfwm-rjjf AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel |
Medium EPSS 0.21% |
>= 3.0.0, < 3.0.12 | 3.0.12 |
| GHSA-3wp9-xfwm-rjjf AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel |
Medium EPSS 0.21% |
>= 2.0.0, < 2.16.1 | 2.16.1 |
| GHSA-mfj3-87qq-382v AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random source |
Low EPSS 0.26% |
>= 3.0.0, < 3.0.12 | 3.0.12 |
| GHSA-mfj3-87qq-382v AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random source |
Low EPSS 0.26% |
>= 2.0.0, < 2.16.1 | 2.16.1 |
| GHSA-jmqq-x5g9-9p2w AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host |
Critical EPSS 0.19% |
>= 2.0.0, < 2.16.1 | 2.16.1 |
| GHSA-jmqq-x5g9-9p2w AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host |
Critical EPSS 0.19% |
>= 3.0.0, < 3.0.13 | 3.0.13 |
| GHSA-f9m8-cv68-674w AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.uk |
Medium EPSS 0.26% |
>= 3.0.0, < 3.0.13 | 3.0.13 |
| GHSA-f9m8-cv68-674w AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.uk |
Medium EPSS 0.26% |
>= 2.0.0, < 2.16.1 | 2.16.1 |
| GHSA-rqf5-2wxv-rjf4 AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext |
High EPSS 0.24% |
>= 2.0.0, < 2.16.1 | 2.16.1 |
| GHSA-rqf5-2wxv-rjf4 AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext |
High EPSS 0.24% |
>= 3.0.0.Beta1, < 3.0.13 | 3.0.13 |
| GHSA-v2j5-22fr-j62r AsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy logins |
High EPSS 0.19% |
>= 3.0.0, < 3.0.14 | 3.0.14 |
| GHSA-v2j5-22fr-j62r AsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy logins |
High EPSS 0.19% |
>= 2.0.0, <= 2.16.1 | No fix yet |
| GHSA-2jwh-9rmr-j4xf AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader (Bypass of CVE-2024-53990 Fix) |
Medium EPSS 0.30% |
>= 3.0.0, < 3.0.14 | 3.0.14 |
| GHSA-2jwh-9rmr-j4xf AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader (Bypass of CVE-2024-53990 Fix) |
Medium EPSS 0.30% |
>= 2.1.0, <= 2.16.1 | No fix yet |
| GHSA-x8v2-478q-2hvg AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabled |
High EPSS 0.43% |
>= 2.2.0, <= 2.16.1 | No fix yet |
| GHSA-x8v2-478q-2hvg AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabled |
High EPSS 0.43% |
>= 3.0.0, < 3.0.14 | 3.0.14 |
| GHSA-xr57-gcx8-52hf AsyncHttpClient sends origin credentials to the proxy on the plaintext CONNECT request |
Medium EPSS 0.27% |
>= 3.0.0, < 3.0.12 | 3.0.12 |
| GHSA-xr57-gcx8-52hf AsyncHttpClient sends origin credentials to the proxy on the plaintext CONNECT request |
Medium EPSS 0.27% |
>= 2.0.0, < 2.16.1 | 2.16.1 |
| GHSA-fj9w-c36g-h5x8 AsyncHttpClient doesn't verify SCRAM and Digest mutual-authentication responses |
Low EPSS 0.41% |
>= 3.0.8, < 3.0.12 | 3.0.12 |
| GHSA-7grg-jcf7-rpmx AsyncHttpClient's unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of service |
High EPSS 0.63% |
>= 2.0.0, < 2.16.1 | 2.16.1 |
| GHSA-7grg-jcf7-rpmx AsyncHttpClient's unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of service |
High EPSS 0.63% |
>= 3.0.0, < 3.0.12 | 3.0.12 |
| GHSA-f8m2-889x-vw4x AsyncHttpClient re-sends client-wide realm credentials to a cross-origin redirect target |
Medium EPSS 0.53% |
>= 2.14.5, < 2.16.1 | 2.16.1 |
| GHSA-f8m2-889x-vw4x AsyncHttpClient re-sends client-wide realm credentials to a cross-origin redirect target |
Medium EPSS 0.53% |
>= 3.0.9, < 3.0.12 | 3.0.12 |
| GHSA-m452-q8c9-rg2f AsyncHttpClient stores cookie for an unrelated domain (cookie tossing) via ThreadSafeCookieStore |
Medium EPSS 0.33% |
>= 2.0.0, < 2.16.0 | 2.16.0 |
| GHSA-m452-q8c9-rg2f AsyncHttpClient stores cookie for an unrelated domain (cookie tossing) via ThreadSafeCookieStore |
Medium EPSS 0.33% |
>= 3.0.0.Beta1, < 3.0.11 | 3.0.11 |
| GHSA-fmxf-pm6p-7xgm async-http-client: Cookie header not stripped on cross-origin redirect |
High EPSS 0.40% |
>= 3.0.0.Beta1, < 3.0.10 | 3.0.10 |
| GHSA-fmxf-pm6p-7xgm async-http-client: Cookie header not stripped on cross-origin redirect |
High EPSS 0.40% |
>= 2.0.0, < 2.15.0 | 2.15.0 |
| GHSA-cmxv-58fp-fm3g AsyncHttpClient leaks authorization credentials to untrusted domains on cross-origin redirects |
Medium EPSS 0.41% |
>= 2.0.0, < 2.14.5 | 2.14.5 |
| GHSA-cmxv-58fp-fm3g AsyncHttpClient leaks authorization credentials to untrusted domains on cross-origin redirects |
Medium EPSS 0.41% |
>= 3.0.0.Beta1, < 3.0.9 | 3.0.9 |
| GHSA-mfj5-cf8g-g2fv AsyncHttpClient (AHC) library's `CookieStore` replaces explicitly defined `Cookie`s |
Critical EPSS 0.72% |
>= 3.0.0.Beta1, < 3.0.1 | 3.0.1 |
| GHSA-mfj5-cf8g-g2fv AsyncHttpClient (AHC) library's `CookieStore` replaces explicitly defined `Cookie`s |
Critical EPSS 0.72% |
>= 2.1.0, < 2.12.4 | 2.12.4 |
| GHSA-93jq-624g-4p9p Improper Input Validation in async-http-client |
High EPSS 3.05% |
< 2.0.35 | 2.0.35 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor