What is CVE-2026-107232?

CVE-2026-107232 is a high-severity vulnerability in Asynchttpclient Async-Http-Client, classified under Cleartext Transmission of Sensitive Information. CVSS score: 7.5/10. Published 2026-10-07.

How severe is CVE-2026-107232?

High severity. CVSS v3 base score is 7.5 out of 10.

Vulnerability in Asynchttpclient Async-Http-Client

CVE-2026-107232

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 on 3.x and 2.16.1 on 2.x, the client infers that an HTTP proxy tunnel exists from the last request method rather than the CONNECT result. After a proxy rejects CONNECT, redirect or authentication handlers can write an origin request and its Authorization credentials onto the still-plaintext proxy connection. Basic credentials can be recovered directly, while NTLM responses may be cracked or relayed. This issue is fixed in versions 3.0.12 and 2.16.1.

Published 2026-10-07 · last modified 2026-10-08.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Asynchttpclient Async-Http-Client — versions >= 2.0.0, < 2.16.1, >= 3.0.0, < 3.0.12

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2026-107232?: CVE-2026-107232 is a high-severity vulnerability in Asynchttpclient Async-Http-Client, classified under Cleartext Transmission of Sensitive Information. CVSS score: 7.5/10. Published 2026-10-07.
How severe is CVE-2026-107232?: High severity. CVSS v3 base score is 7.5 out of 10.