CVE-2026-107283

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, Realm.Builder generates the HTTP Digest client nonce with ThreadLocalRandom rather than a cryptographically secure random source. Digest relies on an unpredictable cnonce to resist chosen-plaintext and credential precomputation attacks, so an observer able to infer generator state can reduce the protection of the authentication exchange. This issue is fixed in versions 3.0.12 and 2.16.1.

• CWE-338

• https://github.com/AsyncHttpClient/async-http-client/commit/dca2d90db87f0144ea893a6858dca13c426d06b6
• https://github.com/AsyncHttpClient/async-http-client/commit/e1f5fc88fe211d3f64032c33b91093ba3d5e793d
• https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-2.16.1
• https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.12
• https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-mfj3-87qq-382v

Published

Oct 7, 2026

Last Modified

Oct 7, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-107276MISP contains a race condition in the email-based one-time p…6.3
• CVE-2026-107278MISP contains a validation flaw in its object synchronizatio…5.3
• CVE-2026-107279The AsyncHttpClient (AHC) library allows Java applications t…8.8
• CVE-2026-107280The AsyncHttpClient (AHC) library allows Java applications t…6.9
• CVE-2026-107281The AsyncHttpClient (AHC) library allows Java applications t…7.6
• CVE-2026-107282The AsyncHttpClient (AHC) library allows Java applications t…9.4
• CVE-2026-107284The AsyncHttpClient (AHC) library allows Java applications t…3.7
• CVE-2026-107285The AsyncHttpClient (AHC) library allows Java applications t…5.9
• CVE-2026-10729An HTML injection vulnerability in the notification email fo…1.2
• CVE-2026-1073The Purchase Button For Affiliate Link plugin for WordPress …4.3
• CVE-2026-10731SQL injection in the ‘two_steps_auth_code’ parameter process…9.3
• CVE-2026-107313pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 and 42.7…4.2