Advisories · Technology
AsyncHttpClient async-http-client.
Every CVE that names AsyncHttpClient async-http-client among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 5.8 Medium
AsyncHttpClient: Resumable download index store is created world-readable and follows a planted symlink
- AsyncHttpClient async-http-client
- Broken access control
- CWE-61
- CVSS 3.7 Low
AsyncHttpClient: WebSocket handshake continues after a failed Sec-WebSocket-Accept check
- AsyncHttpClient async-http-client
- CWE-345
- CWE-670
- CVSS 7.6 High
AsyncHttpClient: Connection pool key omits the authenticated principal, so an NTLM or Negotiate connection is reused across identities
- AsyncHttpClient async-http-client
- Broken access control
- CWE-346
- CVSS 8.8 High
AsyncHttpClient: Digest mutual authentication is switched off by a peer offering qop=auth-int
- AsyncHttpClient async-http-client
- Authentication bypass
- CWE-757
- CVSS 7.5 High
AsyncHttpClient: Origin credentials sent in cleartext to a proxy that rejects the CONNECT
- AsyncHttpClient async-http-client
- Weak cryptography or TLS
- Hard-coded credentials
- CVSS 4.0 Medium
AsyncHttpClient: Incomplete origin checks in the default cookie store allow cookie tossing onto public-suffix and IP-address hosts
- AsyncHttpClient async-http-client
- Authentication bypass
- CWE-1275
- CVSS 5.9 Medium
AsyncHttpClient: Connection permit leak on TLS handshake failure causes per-host denial of service
- AsyncHttpClient async-http-client
- Denial of service
- CVSS 7.5 High
AsyncHttpClient: SOCKS proxy credentials sent to the origin server over plaintext HTTP
- AsyncHttpClient async-http-client
- Weak cryptography or TLS
- Hard-coded credentials