org.asynchttpclient:async-http-client@2.1.0-alpha22

org.asynchttpclient:async-http-client is a maven plugin for the Async Http Client (AHC) classes.

Affected versions of this package are vulnerable to Cleartext Transmission of Sensitive Information via the ResponseFilter failover and retry process. An attacker can intercept sensitive information, such as authorization credentials or plaintext requests, by triggering a replay to a different host, causing the original host's request data to be sent to the unintended destination.

Note: Replaying to the same host is not affected.

Upgrade org.asynchttpclient:async-http-client to version 2.16.1, 3.0.13 or higher.

org.asynchttpclient:async-http-client is a maven plugin for the Async Http Client (AHC) classes.

Affected versions of this package are vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in the Realm.Builder process, which generates the HTTP Digest client nonce using a predictable random source. An attacker can compromise the security of authentication exchanges by inferring the state of the random generator and reducing the effectiveness of the authentication mechanism.

Upgrade org.asynchttpclient:async-http-client to version 2.16.1, 3.0.12 or higher.

org.asynchttpclient:async-http-client is a maven plugin for the Async Http Client (AHC) classes.

Affected versions of this package are vulnerable to Sensitive Cookie with Improper SameSite Attribute via improper validation of the Domain attribute in the cookie handling process. An attacker can inject or overwrite session-relevant cookie values across unrelated origins by setting a cookie for a public suffix, causing the shared cookie store to send it to multiple hosts.

Upgrade org.asynchttpclient:async-http-client to version 2.16.1, 3.0.13 or higher.

org.asynchttpclient:async-http-client is a maven plugin for the Async Http Client (AHC) classes.

Affected versions of this package are vulnerable to Origin Validation Error in the connection pooling process. An attacker can gain unauthorized access to sensitive data or perform actions with another user's authority by exploiting the reuse of pooled connections across different authentication identities.

Upgrade org.asynchttpclient:async-http-client to version 3.0.14 or higher.

org.asynchttpclient:async-http-client is a maven plugin for the Async Http Client (AHC) classes.

Affected versions of this package are vulnerable to Cleartext Transmission of Sensitive Information in the Realm.Builder process when a Digest challenge is received without a usable nonce, causing a downgrade to Basic authentication and transmitting credentials in cleartext. An attacker can intercept sensitive information by manipulating the authentication challenge to omit or empty the nonce value.

Upgrade org.asynchttpclient:async-http-client to version 2.16.1, 3.0.13 or higher.

org.asynchttpclient:async-http-client is a maven plugin for the Async Http Client (AHC) classes.

Affected versions of this package are vulnerable to Origin Validation Error in the connection pooling process. An attacker can gain unauthorized access to resources or perform actions as another authenticated user by exploiting the reuse of pooled connections across different authenticated principals when using NTLM or Negotiate authentication.

Upgrade org.asynchttpclient:async-http-client to version 2.16.1, 3.0.13 or higher.

org.asynchttpclient:async-http-client is a maven plugin for the Async Http Client (AHC) classes.

Affected versions of this package are vulnerable to Cleartext Transmission of Sensitive Information via the proxy connection process. An attacker can intercept sensitive credentials by acting as a malicious proxy that rejects the CONNECT request, causing the client to send origin credentials in cleartext over an unencrypted channel.

Upgrade org.asynchttpclient:async-http-client to version 2.16.1, 3.0.12 or higher.

org.asynchttpclient:async-http-client is a maven plugin for the Async Http Client (AHC) classes.

Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity in the WebSocket handshake process. An attacker can cause unauthorized frames to be decoded and delivered by sending a crafted response with an invalid or missing Sec-WebSocket-Accept value, allowing the connection to proceed further than intended.

Upgrade org.asynchttpclient:async-http-client to version 2.16.1, 3.0.12 or higher.

org.asynchttpclient:async-http-client is a maven plugin for the Async Http Client (AHC) classes.

Affected versions of this package are vulnerable to Cleartext Transmission of Sensitive Information through proxy-auth handling in NettyRequestFactory.newNettyRequest and NettyRequestSender.writeRequest. An attacker can steal proxy credentials by causing the client to send a Proxy-Authorization header on a request routed through a SOCKS proxy, where the request is tunneled directly to the origin server instead of the proxy. When preemptive proxy authentication is enabled, the origin receives the proxy credentials on the initial request; when it is not, a hostile origin can return 407 Proxy Authentication Required and the client will answer with the proxy’s credentials over the same tunnel. This exposes Basic credentials in plaintext and can also disclose NTLM, Kerberos, or SPNEGO proxy authentication material to the origin and anyone observing traffic on that side of the connection.

Workarounds

• Do not configure proxy authentication on a SOCKS proxy.

Upgrade org.asynchttpclient:async-http-client to version 2.16.1, 3.0.12 or higher.

org.asynchttpclient:async-http-client is a maven plugin for the Async Http Client (AHC) classes.

Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the newNettyRequest and writeRequest/sendRequestWithNewChannel paths in NettyRequestFactory and NettyRequestSender. An attacker can capture origin credentials by causing a request to an HTTPS origin to be sent through an HTTP proxy, where the client places preemptive Authorization headers on the plaintext CONNECT request. This leaks Basic, Digest, NTLM, SPNEGO, or Kerberos credentials to the proxy and any observer on the client-to-proxy hop, exposing secrets intended only for the origin server.

Workarounds

• Do not use preemptive origin authentication together with an HTTP proxy; disable preemptive origin auth for proxied HTTPS requests so origin Authorization headers are not sent on the plaintext CONNECT to the proxy.
• Reach the origin without a CONNECT proxy; route the request directly to the HTTPS origin so origin credentials are not exposed on the client-to-proxy hop.

Upgrade org.asynchttpclient:async-http-client to version 2.16.1, 3.0.12 or higher.

org.asynchttpclient:async-http-client is a maven plugin for the Async Http Client (AHC) classes.

Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data (Data Amplification) through ChannelManager.newHttpContentDecompressor() in client/src/main/java/org/asynchttpclient/netty/channel/ChannelManager.java. An attacker can exhaust the client's heap and trigger an OutOfMemoryError by sending a small gzip, deflate, or snappy response that inflates without limit during automatic decompression. The vulnerable HTTP/1.1 path uses Netty's HttpContentDecompressor with the no-argument constructor, so a hostile or compromised server, or an attacker who can alter a response in transit, can make the client allocate decompressed data until memory is exhausted.

Workarounds

• Disable automatic decompression with setEnableAutomaticDecompression(false) and decompress responses manually with your own size limit; this prevents the HTTP/1.1 client from inflating attacker-controlled bodies without bound.
• On the 2.x line, remove the inflater handler through httpAdditionalChannelInitializer; this prevents the client from installing the unbounded decompressor at all.
• Run the client behind a proxy that caps response sizes; this limits how much compressed data can reach the client and reduces decompression-bomb impact.

Upgrade org.asynchttpclient:async-http-client to version 2.16.1, 3.0.12 or higher.

org.asynchttpclient:async-http-client is a maven plugin for the Async Http Client (AHC) classes.

Affected versions of this package are vulnerable to Sensitive Cookie with Improper SameSite Attribute via ThreadSafeCookieStore in ThreadSafeCookieStore.add(...). An attacker can plant a cookie for an unrelated domain by sending a response with a Set-Cookie header whose Domain attribute names a victim domain, causing the client to store that cookie and later send it on requests to the victim site. This affects applications that reuse one AsyncHttpClient cookie jar across attacker-influenced hosts and trusted hosts, such as crawlers, URL fetchers, or redirect-following clients. The result is session fixation or cookie override on the victim domain, so user requests can carry attacker-chosen cookies instead of the intended ones.

Notes

• Applications that share a single CookieStore across both attacker-influenced origins and trusted origins are the exposed deployment pattern; isolated per-trust-domain jars are not affected by this issue.
• The stored cookie is not limited to the response host’s exact name: a response from one host can plant a cookie for an unrelated parent or sibling domain via the Domain attribute, so later requests to that victim domain receive the attacker-chosen value.

Workarounds

• Disable the cookie store by calling setCookieStore(null) when cookies are not needed; this prevents an attacker-influenced host from planting cookies that will later be sent to a trusted domain.
• Use a separate AsyncHttpClient instance, with its own cookie store, for each trust domain; this prevents attacker-controlled hosts and trusted hosts from sharing the same cookie jar.
• If you must keep a shared client, supply a custom CookieStore whose add(Uri, Cookie) rejects cookies whose Domain is not domain-matched by the request host; this blocks unrelated-domain cookies from being stored.

Upgrade org.asynchttpclient:async-http-client to version 2.16.0, 3.0.11 or higher.

org.asynchttpclient:async-http-client is a maven plugin for the Async Http Client (AHC) classes.

Affected versions of this package are vulnerable to Exposure of Sensitive System Information to an Unauthorized Control Sphere via the propagatedHeaders() method during cross-origin redirects, where Cookie headers are not stripped when forwarding requests to a new origin. An attacker can obtain sensitive session cookies, CSRF tokens, or API keys by leveraging an open redirect, a compromised CDN or API gateway, or a man-in-the-middle attack on a plaintext hop in the redirect chain.

Upgrade org.asynchttpclient:async-http-client to version 2.15.0, 3.0.10 or higher.