{
  "schemaVersion": 1,
  "incident": {
    "id": "cve-2026-107282",
    "url": "https://cveboard.org/i/cve-2026-107282",
    "urlPt": "https://cveboard.org/pt/i/cve-2026-107282",
    "json": "https://cveboard.org/i/cve-2026-107282.json",
    "kind": "vuln",
    "live": false,
    "knownExploited": false,
    "severity": "critical",
    "title": "AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host",
    "summary": "When a request is replayed onto a different host, the client updates only the current request and leaves the target request pointing at the original host. Four consumers read that stale value, and each one sends the first host's request, credentials, or both to the second host.",
    "titlePt": "AsyncHttpClient: Replay para um host diferente envia a solicitação e as credenciais do host original para o novo host.",
    "summaryPt": "Quando uma solicitação é repetida em um host diferente, o cliente atualiza apenas a solicitação atual e deixa a solicitação de destino apontando para o host original. Quatro consumidores leem esse valor desatualizado, e cada um envia a solicitação do primeiro host, as credenciais ou ambas para o segundo host.",
    "cves": [
      "CVE-2026-107282"
    ],
    "ghsa": "GHSA-jmqq-x5g9-9p2w",
    "cvss": {
      "score": 9.4,
      "version": "4.0"
    },
    "epss": {
      "percentage": 0.00189,
      "percentile": 0.07775,
      "asOf": "2026-10-23"
    },
    "packages": [
      {
        "ecosystem": "maven",
        "name": "org.asynchttpclient:async-http-client",
        "vulnerable": ">= 3.0.0, <= 3.0.12",
        "fixed": "3.0.13",
        "advisory": "GHSA-jmqq-x5g9-9p2w"
      },
      {
        "ecosystem": "maven",
        "name": "org.asynchttpclient:async-http-client",
        "vulnerable": ">= 2.0.0, <= 2.16.0",
        "fixed": "2.16.1",
        "advisory": "GHSA-jmqq-x5g9-9p2w"
      }
    ],
    "vendor": null,
    "product": null,
    "kev": null,
    "breach": null,
    "retracted": false,
    "sources": [
      {
        "label": "GitHub Advisory Database",
        "url": "https://github.com/advisories/GHSA-jmqq-x5g9-9p2w"
      }
    ],
    "publishedAt": "2026-10-08T16:30:46.000Z",
    "updatedAt": "2026-10-08T16:30:46.000Z"
  },
  "live": false,
  "events": [
    {
      "id": "ghsa:GHSA-jmqq-x5g9-9p2w:ghsa_published:2026-10-08T16:30:46.000Z",
      "incidentId": "cve-2026-107282",
      "type": "ghsa_published",
      "at": "2026-10-08T16:30:46.000Z",
      "detail": {
        "ghsa": "GHSA-jmqq-x5g9-9p2w",
        "severity": "critical",
        "fixed": "3.0.13, 2.16.1"
      }
    }
  ]
}