CVE-2026-107283
AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random source
CVSS Score
3.7
EPSS Score
0.0%
EPSS Percentile
0th
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, Realm.Builder generates the HTTP Digest client nonce with ThreadLocalRandom rather than a cryptographically secure random source. Digest relies on an unpredictable cnonce to resist chosen-plaintext and credential precomputation attacks, so an observer able to infer generator state can reduce the protection of the authentication exchange. This issue is fixed in versions 3.0.12 and 2.16.1.
| CWE | CWE-338 |
| Vendor | asynchttpclient |
| Product | async-http-client |
| Published | Oct 7, 2026 |
Stay Ahead of the Next One
Get instant alerts for asynchttpclient async-http-client
Be the first to know when new low vulnerabilities affecting asynchttpclient async-http-client are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Affected Versions
AsyncHttpClient / async-http-client
>= 3.0.0, < 3.0.12 >= 2.0.0, < 2.16.1
References
github.com: https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-mfj3-87qq-382v github.com: https://github.com/AsyncHttpClient/async-http-client/commit/dca2d90db87f0144ea893a6858dca13c426d06b6 github.com: https://github.com/AsyncHttpClient/async-http-client/commit/e1f5fc88fe211d3f64032c33b91093ba3d5e793d github.com: https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-2.16.1 github.com: https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.12