{"id":"CVE-2026-85717","summary":"AsyncHttpClient: Client-wide realm credentials re-sent to a cross-origin redirect target","details":"The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.14.5 to 2.16.0 and from 3.0.9 to 3.0.11, a client configured with a client-wide Realm and redirect following can disclose credentials after a cross-origin redirect because the Interceptors authentication path falls back to the client configuration after redirect handling clears the per-exchange realm. If the attacker-controlled target returns 401, the client can send Basic or Digest credentials or a Negotiate or NTLM token to that origin. Per-request realms are stripped correctly, and this issue is a residual bypass of the earlier cross-origin credential-stripping fixes. This issue is fixed in versions 2.16.1 and 3.0.12.","aliases":["GHSA-f8m2-889x-vw4x"],"modified":"2026-09-24T08:05:02.150287Z","published":"2026-09-17T15:53:39.875Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85717.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-200","CWE-522"]},"references":[{"type":"ADVISORY","url":"https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-f8m2-889x-vw4x"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85717.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85717"},{"type":"FIX","url":"https://github.com/AsyncHttpClient/async-http-client/commit/43db7bba81430cbd61ec2dc2c7be464e0ff6a0ff"},{"type":"FIX","url":"https://github.com/AsyncHttpClient/async-http-client/commit/b66757bec34def2e9867bb2b77bd848b1112abb4"},{"type":"FIX","url":"https://github.com/AsyncHttpClient/async-http-client/pull/2224"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/asynchttpclient/async-http-client","events":[{"introduced":"ae557ad35246721c09dafb2976609cd0004e78ae"},{"introduced":"1ab1ea31fcaa0b016130d9f08cd5334feb2d1d93"},{"fixed":"d1f0ccec417092098d40242fee7dfac84bb3c21f"},{"fixed":"c07038b44e5206375662b46859672e8f1df9f05a"},{"fixed":"43db7bba81430cbd61ec2dc2c7be464e0ff6a0ff"},{"fixed":"b66757bec34def2e9867bb2b77bd848b1112abb4"}],"database_specific":{"extracted_events":[{"introduced":"2.14.5"},{"fixed":"2.16.1"},{"introduced":"3.0.9"},{"fixed":"3.0.12"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["async-http-client-project-2.16.0","async-http-client-project-2.15.0","async-http-client-project-3.0.11","async-http-client-project-3.0.10","async-http-client-project-3.0.9","async-http-client-project-2.14.5"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-85717.json","vanir_signatures_modified":"2026-09-24T08:05:02Z","vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/d1f0ccec417092098d40242fee7dfac84bb3c21f","target":{"file":"client/src/main/java/org/asynchttpclient/cookie/ThreadSafeCookieStore.java"},"deprecated":false,"digest":{"line_hashes":["219246596221720898981563676126452787927","112413554918931264338179563940130289539","262908889413526511266896616639455764237"],"threshold":0.9},"id":"CVE-2026-85717-26220b3f"},{"target":{"file":"client/src/test/java/org/asynchttpclient/RedirectCredentialSecurityTest.java","function":"startServers"},"deprecated":false,"digest":{"function_hash":"184009208900755675943023404748893370663","length":4882},"id":"CVE-2026-85717-2cd752fd","signature_type":"Function","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/43db7bba81430cbd61ec2dc2c7be464e0ff6a0ff"},{"digest":{"function_hash":"241393853802948463620791340251047477124","length":5325},"id":"CVE-2026-85717-5545403e","signature_type":"Function","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/b66757bec34def2e9867bb2b77bd848b1112abb4","target":{"file":"client/src/test/java/org/asynchttpclient/RedirectCredentialSecurityTest.java","function":"startServers"},"deprecated":false},{"id":"CVE-2026-85717-7ab65a47","signature_type":"Line","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/43db7bba81430cbd61ec2dc2c7be464e0ff6a0ff","target":{"file":"client/src/test/java/org/asynchttpclient/RedirectCredentialSecurityTest.java"},"deprecated":false,"digest":{"line_hashes":["76474214396730061469783811740400741500","204603471147328128174695634701278902105","68384609722284682341058103555844221330","282810287519263333484570046753837592032","81671904131358807237731526954193979982","251938332087782189967162072465881740844","100736082375505397084409997457753738898","49137876904396146127075179432178697958","107453322290419343400819515691789716070","90528517945449657848656305410295890180","197607451851055902265844210649427662551","94809090037378499247250609020830998758","45463429962871820414932086669367837580"],"threshold":0.9}},{"id":"CVE-2026-85717-81d12158","signature_type":"Function","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/43db7bba81430cbd61ec2dc2c7be464e0ff6a0ff","target":{"function":"exitAfterIntercept","file":"client/src/main/java/org/asynchttpclient/netty/handler/intercept/Interceptors.java"},"deprecated":false,"digest":{"function_hash":"212258540344916751724864665431810523374","length":1478}},{"target":{"file":"client/src/main/java/org/asynchttpclient/netty/handler/intercept/Interceptors.java"},"deprecated":false,"digest":{"line_hashes":["225565141248320595934937395809500783613","242343515445931555414066584996557268149","163715264400786534397493848134757466046","40179504555055141142828355367061676436"],"threshold":0.9},"id":"CVE-2026-85717-c14fd6ca","signature_type":"Line","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/b66757bec34def2e9867bb2b77bd848b1112abb4"},{"signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/b66757bec34def2e9867bb2b77bd848b1112abb4","target":{"file":"client/src/test/java/org/asynchttpclient/RedirectCredentialSecurityTest.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["54289836295184197265711419203810783766","235445810451018097122068040748536847398","70669224714332450542924553577060680104","285543063446836095755120805065194255136","141857047890905438563829620685494211698","190300941236298590702403977605206298263","164123811326698259967112625327587301246","66334450511794396711415949674297370618","12155388834262985759899981192895395181","321860887365735582908914497695102329178"]},"id":"CVE-2026-85717-c266ee0c","signature_type":"Line"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/d1f0ccec417092098d40242fee7dfac84bb3c21f","target":{"file":"client/src/main/java/org/asynchttpclient/cookie/ThreadSafeCookieStore.java","function":"add"},"deprecated":false,"digest":{"function_hash":"319981061666573934872902157208912328509","length":685},"id":"CVE-2026-85717-c7b286ac"},{"deprecated":false,"digest":{"line_hashes":["225565141248320595934937395809500783613","242343515445931555414066584996557268149","163715264400786534397493848134757466046","40179504555055141142828355367061676436"],"threshold":0.9},"id":"CVE-2026-85717-d1269e89","signature_type":"Line","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/43db7bba81430cbd61ec2dc2c7be464e0ff6a0ff","target":{"file":"client/src/main/java/org/asynchttpclient/netty/handler/intercept/Interceptors.java"}},{"id":"CVE-2026-85717-e5f54550","signature_type":"Function","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/b66757bec34def2e9867bb2b77bd848b1112abb4","target":{"file":"client/src/main/java/org/asynchttpclient/netty/handler/intercept/Interceptors.java","function":"exitAfterIntercept"},"deprecated":false,"digest":{"function_hash":"262008857587229939276875489319346709946","length":2008}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N"}]}