Async-HTTP-Client users urged to patch CVE-2026-107282 to stop credential leaks during failover replays

A critical vulnerability in Async-HTTP-Client, a widely used Java library for making HTTP requests, has been patched. The flaw, tracked as CVE-2026-107282, caused the client to send authentication credentials and request data to the wrong server when requests were replayed due to failover or retry mechanisms. This behavior exposed sensitive data to unintended hosts, potentially allowing attackers to intercept credentials or manipulate requests.

In plain English

The issue stems from how the client handles request replays. When an application uses failover or retry features—common patterns for improving reliability—the client may redirect a request to a different host. However, the library failed to update the target host reference for certain internal components. As a result, the client continued to associate the original request’s credentials and headers with the new host.

For example, if a request to Host A failed and was replayed to Host B, the client might still send Host A’s authorization header to Host B. This occurred even when the connection was secured with TLS, as the handshake was correctly negotiated with Host B, masking the mismatch. In some cases, if the original request was unencrypted (HTTP) and the replay was encrypted (HTTPS), the client would send credentials in cleartext because it failed to install the necessary SSL handler.

The background

The vulnerability affects both the 2.x and 3.x lines of Async-HTTP-Client. Specifically, versions 2.0.0 through 2.16.0 and 3.0.0 through 3.0.12 are vulnerable. The issue is described as long-standing behavior rather than a recent regression, meaning it has been present since the introduction of these features. The flaw impacts four distinct consumers within the client, each of which could leak credentials or request data to the wrong host during a replay.

What changes now

Patches have been released for both affected version lines. Version 2.16.1 addresses the issue for the 2.x line, while version 3.0.13 fixes it for the 3.x line. The updates ensure that the target request and proxy settings are correctly updated when a request is replayed. Additionally, the proxy is now included in the connection pool key, preventing misdirected requests due to pool mismatches. Organizations using Async-HTTP-Client should update to the latest patched versions to mitigate the risk of credential leakage.

What to do and how to stay safe: Async-HTTP-Client

• Inventory all applications using Async-HTTP-Client and identify the installed versions.
• Update to version 2.16.1 or 3.0.13, depending on your current major version line.
• Monitor logs for unusual authentication attempts or data exfiltration to unexpected hosts.
• Review failover and retry configurations to ensure they align with security best practices.

Step-by-step guide: Automatic Updates Mistakes That Leave Systems Exposed

General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-107282?

It is a critical vulnerability in Async-HTTP-Client that causes credentials to be sent to the wrong host during request replays.

Which versions of Async-HTTP-Client are affected?

Versions 2.0.0 through 2.16.0 and 3.0.0 through 3.0.12 are vulnerable.

Is there a fix available?

Yes, patches are available in versions 2.16.1 and 3.0.13.