Vulnerabilidades em AsyncHttpClient
25 resultadosAnálise Vexday
AsyncHttpClient apresenta 4 vulnerabilidades catalogadas, com 1 crítica e 2 descobertas nos últimos 90 dias, indicando risco recente. A fraqueza predominante é exposição de informação (CWE-200), embora nenhuma vulnerabilidade esteja sob exploração ativa conhecida no momento.
CVE-2024-53990CRITICALAsyncHttpClient (AHC) library's `CookieStore` replaces explicitly defined `Cookie`sEPSS 0.7%CVE-2026-85721HIGHAsyncHttpClient: Unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of serviceEPSS 0.6%CVE-2026-85718MEDIUMAsyncHttpClient: Connection permit leak on TLS handshake failure causes per-host denial of serviceEPSS 0.5%CVE-2026-85717MEDIUMAsyncHttpClient: Client-wide realm credentials re-sent to a cross-origin redirect targetEPSS 0.5%CVE-2026-107227HIGHAsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabledEPSS 0.4%CVE-2026-40490MEDIUMAsyncHttpClient leaks authorization credentials to untrusted domains on cross-origin redirectsEPSS 0.4%CVE-2026-85716LOWAsyncHttpClient: SCRAM and Digest mutual-authentication responses are not verifiedEPSS 0.4%CVE-2026-45300HIGHasync-http-client: Cookie header not stripped on cross-origin redirectEPSS 0.4%CVE-2026-85719HIGHAsyncHttpClient: SOCKS proxy credentials sent to the origin server over plaintext HTTPEPSS 0.4%CVE-2026-107279HIGHAsyncHttpClient: Digest mutual authentication is switched off by a peer offering qop=auth-intEPSS 0.4%CVE-2026-55688MEDIUMAsyncHttpClient: Cookie stored for an unrelated domain (cookie tossing) via ThreadSafeCookieStoreEPSS 0.3%CVE-2026-107228MEDIUMAsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader (Bypass of CVE-2024-53990 Fix)EPSS 0.3%CVE-2026-107226MEDIUMAsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPSEPSS 0.3%CVE-2026-85720MEDIUMAsyncHttpClient: Origin credentials sent to the proxy on the plaintext CONNECT requestEPSS 0.3%CVE-2026-107283LOWAsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random sourceEPSS 0.3%CVE-2026-107280MEDIUMAsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.ukEPSS 0.3%CVE-2026-107229MEDIUMAsyncHttpClient: Incomplete origin checks in the default cookie store allow cookie tossing onto public-suffix and IP-address hostsEPSS 0.3%CVE-2026-107231HIGHAsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartextEPSS 0.2%CVE-2026-107232HIGHAsyncHttpClient: Origin credentials sent in cleartext to a proxy that rejects the CONNECTEPSS 0.2%CVE-2026-107285MEDIUMAsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnelEPSS 0.2%