{"items":[{"id":"CVE-2026-102740","published":"2026-10-15T17:25:30.183Z","updated":"2026-10-15T18:27:00.104Z","title":"AsyncHttpClient: Resumable download index store is created world-readable and follows a planted symlink","severity":"MEDIUM","score":5.8,"vendor":"AsyncHttpClient","product":"async-http-client","kev":false,"epss":0.001,"kevAdded":null},{"id":"CVE-2026-107226","published":"2026-10-12T18:34:18.996Z","updated":"2026-10-13T20:25:00.134Z","title":"AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPS","severity":"MEDIUM","score":6.8,"vendor":"AsyncHttpClient","product":"async-http-client","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2026-107285","published":"2026-10-07T21:28:34.620Z","updated":"2026-10-08T17:57:33.271Z","title":"AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel","severity":"MEDIUM","score":5.9,"vendor":"AsyncHttpClient","product":"async-http-client","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-107284","published":"2026-10-07T21:27:03.257Z","updated":"2026-10-08T14:54:57.517Z","title":"AsyncHttpClient: WebSocket handshake continues after a failed Sec-WebSocket-Accept check","severity":"LOW","score":3.7,"vendor":"AsyncHttpClient","product":"async-http-client","kev":false,"epss":0.00138,"kevAdded":null},{"id":"CVE-2026-107283","published":"2026-10-07T21:24:56.640Z","updated":"2026-10-08T14:00:20.347Z","title":"AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random source","severity":"LOW","score":3.7,"vendor":"AsyncHttpClient","product":"async-http-client","kev":false,"epss":0.00263,"kevAdded":null},{"id":"CVE-2026-107282","published":"2026-10-07T21:21:29.349Z","updated":"2026-10-10T02:50:16.635Z","title":"AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host","severity":"CRITICAL","score":9.4,"vendor":"AsyncHttpClient","product":"async-http-client","kev":false,"epss":0.00189,"kevAdded":null},{"id":"CVE-2026-107281","published":"2026-10-07T21:19:09.292Z","updated":"2026-10-08T17:58:10.542Z","title":"AsyncHttpClient: Connection pool key omits the authenticated principal, so an NTLM or Negotiate connection is reused across identities","severity":"HIGH","score":7.6,"vendor":"AsyncHttpClient","product":"async-http-client","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2026-107280","published":"2026-10-07T21:15:13.870Z","updated":"2026-10-08T17:57:38.975Z","title":"AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.uk","severity":"MEDIUM","score":6.9,"vendor":"AsyncHttpClient","product":"async-http-client","kev":false,"epss":0.00261,"kevAdded":null},{"id":"CVE-2026-107279","published":"2026-10-07T21:10:26.049Z","updated":"2026-10-08T15:02:48.131Z","title":"AsyncHttpClient: Digest mutual authentication is switched off by a peer offering qop=auth-int","severity":"HIGH","score":8.8,"vendor":"AsyncHttpClient","product":"async-http-client","kev":false,"epss":0.00358,"kevAdded":null},{"id":"CVE-2026-107232","published":"2026-10-07T21:09:03.284Z","updated":"2026-10-08T14:01:19.523Z","title":"AsyncHttpClient: Origin credentials sent in cleartext to a proxy that rejects the CONNECT","severity":"HIGH","score":7.5,"vendor":"AsyncHttpClient","product":"async-http-client","kev":false,"epss":0.00213,"kevAdded":null},{"id":"CVE-2026-107231","published":"2026-10-07T21:06:26.742Z","updated":"2026-10-10T02:48:49.716Z","title":"AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext","severity":"HIGH","score":8.7,"vendor":"AsyncHttpClient","product":"async-http-client","kev":false,"epss":0.00237,"kevAdded":null},{"id":"CVE-2026-107230","published":"2026-10-07T21:00:47.997Z","updated":"2026-10-08T17:59:43.962Z","title":"AsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy logins","severity":"HIGH","score":7.4,"vendor":"AsyncHttpClient","product":"async-http-client","kev":false,"epss":0.00188,"kevAdded":null},{"id":"CVE-2026-107229","published":"2026-10-07T20:57:36.676Z","updated":"2026-10-08T17:57:44.807Z","title":"AsyncHttpClient: Incomplete origin checks in the default cookie store allow cookie tossing onto public-suffix and IP-address hosts","severity":"MEDIUM","score":4,"vendor":"AsyncHttpClient","product":"async-http-client","kev":false,"epss":0.00261,"kevAdded":null},{"id":"CVE-2026-107228","published":"2026-10-07T20:54:34.703Z","updated":"2026-10-08T16:08:44.837Z","title":"AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader (Bypass of CVE-2024-53990 Fix)","severity":"MEDIUM","score":6.8,"vendor":"AsyncHttpClient","product":"async-http-client","kev":false,"epss":0.00301,"kevAdded":null},{"id":"CVE-2026-107227","published":"2026-10-07T20:51:04.823Z","updated":"2026-10-08T14:02:28.739Z","title":"AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabled","severity":"HIGH","score":7.5,"vendor":"AsyncHttpClient","product":"async-http-client","kev":false,"epss":0.00426,"kevAdded":null},{"id":"CVE-2026-85716","published":"2026-09-17T16:23:27.343Z","updated":"2026-09-18T14:44:54.072Z","title":"AsyncHttpClient: SCRAM and Digest mutual-authentication responses are not verified","severity":"LOW","score":3.7,"vendor":"AsyncHttpClient","product":"async-http-client","kev":false,"epss":0.00409,"kevAdded":null},{"id":"CVE-2026-85720","published":"2026-09-17T16:00:01.615Z","updated":"2026-09-21T20:52:24.486Z","title":"AsyncHttpClient: Origin credentials sent to the proxy on the plaintext CONNECT request","severity":"MEDIUM","score":5.9,"vendor":"AsyncHttpClient","product":"async-http-client","kev":false,"epss":0.00265,"kevAdded":null},{"id":"CVE-2026-85718","published":"2026-09-17T15:58:40.719Z","updated":"2026-09-17T16:40:07.831Z","title":"AsyncHttpClient: Connection permit leak on TLS handshake failure causes per-host denial of service","severity":"MEDIUM","score":5.9,"vendor":"AsyncHttpClient","product":"async-http-client","kev":false,"epss":0.00533,"kevAdded":null},{"id":"CVE-2026-85721","published":"2026-09-17T15:55:32.018Z","updated":"2026-09-17T17:22:22.088Z","title":"AsyncHttpClient: Unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of service","severity":"HIGH","score":7.5,"vendor":"AsyncHttpClient","product":"async-http-client","kev":false,"epss":0.0063,"kevAdded":null},{"id":"CVE-2026-85717","published":"2026-09-17T15:53:39.875Z","updated":"2026-09-23T18:46:54.135Z","title":"AsyncHttpClient: Client-wide realm credentials re-sent to a cross-origin redirect target","severity":"MEDIUM","score":6.8,"vendor":"AsyncHttpClient","product":"async-http-client","kev":false,"epss":0.0053,"kevAdded":null},{"id":"CVE-2026-85719","published":"2026-09-17T15:52:16.315Z","updated":"2026-09-18T14:45:01.238Z","title":"AsyncHttpClient: SOCKS proxy credentials sent to the origin server over plaintext HTTP","severity":"HIGH","score":7.5,"vendor":"AsyncHttpClient","product":"async-http-client","kev":false,"epss":0.00361,"kevAdded":null},{"id":"CVE-2026-55688","published":"2026-07-01T19:40:12.004Z","updated":"2026-08-06T21:56:13.231Z","title":"AsyncHttpClient: Cookie stored for an unrelated domain (cookie tossing) via ThreadSafeCookieStore","severity":"MEDIUM","score":4,"vendor":"AsyncHttpClient","product":"async-http-client","kev":false,"epss":0.0033,"kevAdded":null},{"id":"CVE-2026-45300","published":"2026-06-05T19:32:43.547Z","updated":"2026-06-08T16:34:10.203Z","title":"async-http-client: Cookie header not stripped on cross-origin redirect","severity":"HIGH","score":7.4,"vendor":"AsyncHttpClient","product":"async-http-client","kev":false,"epss":0.00399,"kevAdded":null},{"id":"CVE-2026-40490","published":"2026-04-18T01:31:13.860Z","updated":"2026-04-20T14:55:50.254Z","title":"AsyncHttpClient leaks authorization credentials to untrusted domains on cross-origin redirects","severity":"MEDIUM","score":6.8,"vendor":"AsyncHttpClient","product":"async-http-client","kev":false,"epss":0.00415,"kevAdded":null},{"id":"CVE-2024-53990","published":"2024-12-02T17:10:28.229Z","updated":"2024-12-04T17:08:11.472Z","title":"AsyncHttpClient (AHC) library's `CookieStore` replaces explicitly defined `Cookie`s","severity":"CRITICAL","score":9.2,"vendor":"AsyncHttpClient","product":"async-http-client","kev":false,"epss":0.00722,"kevAdded":null}]}