CVE-2026-107281

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, the HTTP/1.1 connection-pool key excludes the authenticated principal for connection-oriented NTLM and Negotiate authentication. A pooled socket authenticated for one request can be reused by a request carrying another principal, and the server executes that later request as the first identity. Basic and Digest are not affected because they authenticate each request. This issue is fixed in versions 3.0.13 and 2.16.1.

• CWE-346
• CWE-863

• https://github.com/AsyncHttpClient/async-http-client/commit/73813babf51231ee79f7da4f07b777f19f48d34d
• https://github.com/AsyncHttpClient/async-http-client/commit/83e552e64cabab2119addb6b47f7c6482997c94e
• https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-2.16.1
• https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.13
• https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-vvp4-63h8-v5pm

Published

Oct 7, 2026

Last Modified

Oct 7, 2026

Status

Received

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-107272Gophish through 0.12.1 contains stored and reflected cross-s…4.7
• CVE-2026-107273Gophish 0.11.0 through 0.12.1 contains a server-side request…4.3
• CVE-2026-107276MISP contains a race condition in the email-based one-time p…6.3
• CVE-2026-107278MISP contains a validation flaw in its object synchronizatio…5.3
• CVE-2026-107279The AsyncHttpClient (AHC) library allows Java applications t…8.8
• CVE-2026-107280The AsyncHttpClient (AHC) library allows Java applications t…6.9
• CVE-2026-107282The AsyncHttpClient (AHC) library allows Java applications t…9.4
• CVE-2026-107283The AsyncHttpClient (AHC) library allows Java applications t…3.7
• CVE-2026-107284The AsyncHttpClient (AHC) library allows Java applications t…3.7
• CVE-2026-107285The AsyncHttpClient (AHC) library allows Java applications t…5.9
• CVE-2026-10729An HTML injection vulnerability in the notification email fo…1.2
• CVE-2026-1073The Purchase Button For Affiliate Link plugin for WordPress …4.3