A
Vendor security profile
AsyncHttpClient
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs20
Critical1
CISA KEV0
Public exploit0
Patch rate%0
Avg. CVSS6.5
12-month vulnerability rate
0
0
0
0
0
0
0
0
1
0
6
13
CVE KEV
CVE severity distribution
20toplam CVE
Critical1 (5%)
High8 (40%)
Medium8 (40%)
Low3 (15%)
Patch and exploitation view
%0
Verified patch
%0
CISA KEV
%0
Public exploit
0Patch available
0Partial
0Workaround
0Vendor: no patch
20Unknown
Latest vulnerabilities
5.9
CVE-2026-107285
AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel
A
Patch status unknownEPSS %0
3.7
CVE-2026-107284
AsyncHttpClient: WebSocket handshake continues after a failed Sec-WebSocket-Accept check
A
Patch status unknownEPSS %0
3.7
CVE-2026-107283
AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random source
A
Patch status unknownEPSS %0
9.4
CVE-2026-107282
AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host
A
Patch status unknownEPSS %0
7.6
CVE-2026-107281
AsyncHttpClient: Connection pool key omits the authenticated principal, so an NTLM or Negotiate connection is reused across identities
A
Patch status unknownEPSS %0
6.9
CVE-2026-107280
AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.uk
A
Patch status unknownEPSS %0
8.8
CVE-2026-107279
AsyncHttpClient: Digest mutual authentication is switched off by a peer offering qop=auth-int
A
Patch status unknownEPSS %0
7.5
CVE-2026-107232
AsyncHttpClient: Origin credentials sent in cleartext to a proxy that rejects the CONNECT
A
Patch status unknownEPSS %0
8.7
CVE-2026-107231
AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext
A
Patch status unknownEPSS %0
7.4
CVE-2026-107230
AsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy logins
A
Patch status unknownEPSS %0