CVE-2026-85717

CVE-2026-85717 · AsyncHttpClient: Client-wide realm credentials re-sent to a cross-origin redirect target

Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.14.5 to 2.16.0 and from 3.0.9 to 3.0.11, a client configured with a client-wide Realm and redirect following can disclose credentials after a cross-origin redirect because the Interceptors authentication path falls back to the client configuration after redirect handling clears the per-exchange realm. If the attacker-controlled target returns 401, the client can send Basic or Digest credentials or a Negotiate or NTLM token to that origin. Per-request realms are stripped correctly, and this issue is a residual bypass of the earlier cross-origin credential-stripping fixes. This issue is fixed in versions 2.16.1 and 3.0.12.

CVSS 6.8 · Mittel · EPSS 0,5%

Veröffentlicht

2026-09-17T15:53:39.875Z

Aktualisiert

2026-09-23T18:46:54.135Z

Technologie-Stack: system

Prüfen Sie Ihren Server →