CVE-2026-107279
AsyncHttpClient: Digest mutual authentication is switched off by a peer offering qop=auth-int
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. In 3.0.12, a peer offering only Digest qop=auth-int causes mutual-authentication verification to be skipped. AuthenticatorUtils.computeExpectedRspAuth returns no expected value for auth-int, and Interceptors treats that result as unverifiable but nonfatal, so a response with an invalid rspauth value is accepted. A peer that does not know the shared secret can therefore be accepted as the authenticated server. This issue is fixed in version 3.0.13.
| CWE | CWE-303 CWE-757 |
| Vendor | asynchttpclient |
| Product | async-http-client |
| Published | Oct 7, 2026 |
| Last Updated | Oct 7, 2026 |
Stay Ahead of the Next One
Get instant alerts for asynchttpclient async-http-client
Be the first to know when new unknown vulnerabilities affecting asynchttpclient async-http-client are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
AsyncHttpClient / async-http-client
= 3.0.12
References
github.com: https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-qhv6-3pmh-95q4 github.com: https://github.com/AsyncHttpClient/async-http-client/commit/a5422493b638226666a1ecb5f82826c7c7845b99 github.com: https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.13