CVE-2026-107282
AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host
When a request is replayed onto a different host, the client updates only the current request and leaves the target request pointing at the original host. Four consumers read that stale value, and each one sends the first host's request, credentials, or both to the second host.
- No known exploitation
- Severity
- Critical, CVSS 9.4 (v4.0)
- EPSS
- 0.19% chance of exploitation in 30 days (EPSS, as of Oct 23, 2026)
- Affected packages
- org.asynchttpclient:async-http-client (maven) >= 3.0.0, <= 3.0.12, fixed in 3.0.13 · GHSA-jmqq-x5g9-9p2w
- org.asynchttpclient:async-http-client (maven) >= 2.0.0, <= 2.16.0, fixed in 2.16.1 · GHSA-jmqq-x5g9-9p2w