Homepage

Information Exposure Affecting druid package, versions <37.0.0-r58

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Threat Intelligence

EPSS
0.53% (43rd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-CHAINGUARDLATEST-DRUID-20027266
  • published21 Sept 2026
  • disclosed17 Sept 2026
Report a new vulnerability Found a mistake?

Introduced: 17 Sep 2026

NewCVE-2026-85717  (opens in a new tab)
CWE-200  (opens in a new tab)
CWE-522  (opens in a new tab)

How to fix?

Upgrade Chainguard druid to version 37.0.0-r58 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream druid package and not the druid package as distributed by Chainguard. See How to fix? for Chainguard relevant fixed versions and status.

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.14.5 to 2.16.0 and from 3.0.9 to 3.0.11, a client configured with a client-wide Realm and redirect following can disclose credentials after a cross-origin redirect because the Interceptors authentication path falls back to the client configuration after redirect handling clears the per-exchange realm. If the attacker-controlled target returns 401, the client can send Basic or Digest credentials or a Negotiate or NTLM token to that origin. Per-request realms are stripped correctly, and this issue is a residual bypass of the earlier cross-origin credential-stripping fixes. This issue is fixed in versions 2.16.1 and 3.0.12.