Answer in brief
CVE-2026-85717 records a Medium severity (CVSS 6.8) vulnerability in AsyncHttpClient: Client-wide realm credentials re-sent to a cross-origin redirect target. The current sources do not mark it as known exploited. The current feed maps AsyncHttpClient/async-http-client (generic), org.asynchttpclient:async-http-client (maven), org.asynchttpclient:async-http-client (maven), org.asynchttpclient:async-http-client (maven) and additional mapped packages. Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 6.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps AsyncHttpClient/async-http-client (generic), org.asynchttpclient:async-http-client (maven), org.asynchttpclient:async-http-client (maven), org.asynchttpclient:async-http-client (maven) and additional mapped packages. Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| AsyncHttpClient/async-http-clientgeneric | >= 2.14.5, < 2.16.1 || >= 3.0.9, < 3.0.12 | Not reported |
| org.asynchttpclient:async-http-clientmaven | >=3.0.9,<=3.0.11 | 3.0.12 |
| org.asynchttpclient:async-http-clientmaven | >=2.14.5,<=2.16.0 | 2.16.1 |
| org.asynchttpclient:async-http-clientmaven | >=3.0.9 <3.0.12 | 3.0.12 |
| org.asynchttpclient:async-http-clientmaven | >=2.14.5 <2.16.1 | 2.16.1 |
Published upstream
Sep 17, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 17, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 17, 2026
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.14.5 to 2.16.0 and from 3.0.9 to 3.0.11, a client configured with a client-wide Realm and redirect following can disclose credentials after a cross-origin redirect because the Interceptors authentication path falls back to the client configuration after redirect handling clears the per-exchange realm. If the attacker-controlled target returns 401, the client can send Basic or Digest credentials or a Negotiate or NTLM token to that origin. Per-request realms are stripped correctly, and this issue is a residual bypass of the earlier cross-origin credential-stripping fixes. This issue is fixed in versions 2.16.1 and 3.0.12.
Quoted source text, attributed separately from HOL analysis.