Async-HTTP-Client Critical Flaw Sends Credentials to Wrong Hosts

A critical vulnerability in the Async-HTTP-Client library allows applications to inadvertently send credentials and request data to unintended hosts. The flaw, identified as CVE-2026-107282, occurs when the client replays a request to a different host, failing to update the target request's host information correctly.

The issue stems from how the client handles request replays, which are common in documented failover and retry patterns. When a request is replayed to a new host, the client updates only the current request object but leaves the target request pointing at the original host. Four distinct consumers within the library read this stale value, resulting in the first host’s request, credentials, or both being sent to the second host. An attacker does not need to force this replay; any application utilizing standard failover features triggers the behavior by design.

Technical Details

The vulnerability manifests in several ways that bypass standard security controls. In one scenario, the socket to the secondary host is filed in the connection pool under the primary host's key. Consequently, a later request addressed to the primary host is served over the connection to the secondary host, sending the primary host's Authorization header to the wrong destination.

Over a CONNECT tunnel, the client tunnels to the secondary host and negotiates TLS with it correctly. However, it then writes the primary host’s request into that tunnel. The secondary host receives the primary host’s path, Host header, and Authorization credentials. TLS does not protect against this because the handshake is legitimately with the secondary host, preventing any certificate mismatch alerts.

Additionally, the replay reuses the original realm, causing the primary host’s credentials to be regenerated onto a replay request that carries no realm of its own. The cross-origin redirect path strips realms to prevent this, but the replay path did not. The stale value also dictates whether TLS is used. If the original request was HTTP and the replay is HTTPS, no SSL handler is installed, and the replayed request, including credentials, is transmitted in cleartext.

Affected Versions

The vulnerability affects long-standing behavior in both major version lines of the library. Versions 2.0.0 through 2.16.0 of the 2.x line are affected, as are versions 3.0.0 through 3.0.12 of the 3.x line. The advisory notes that this is not a recent regression but rather long-standing behavior in the library.

What should you do?

Developers using Async-HTTP-Client should update to the patched versions immediately. The 2.x line is fixed in version 2.16.1, and the 3.x line is fixed in version 3.0.13. The patches ensure that the target request moves when a request is replayed, and the proxy moves with it. The proxy is part of the connection pool key, so correcting only the host would have converted a harmless pool miss into a different issue; the fix addresses the host and proxy movement comprehensively.