Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
3.7
CVE-2026-107283: AsyncHttpClient may use predictable numbers for Digest login
CVE-2026-107283 · published 11 days ago
Summary
The AsyncHttpClient library used by Java programs creates a random value called a “cnonce” with a generator that isn’t designed for security. This makes the value easier for an attacker to guess, weakening the protection of password‑based login. Upgrade AsyncHttpClient to version 3.0.12, 2.16.1 or any newer release.
What to do
- Update org.asynchttpclient:async-http-client to version 3.0.12.
- Update org.asynchttpclient:async-http-client to version 2.16.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | asynchttpclient | async-http-client | >= 3.0.0, < 3.0.12 |
| Debian:12 | debian | async-http-client | All versions |
| maven | – | org.asynchttpclient:async-http-client |
>= 3.0.0, <= 3.0.11 >= 2.0.0, <= 2.16.0 Fix: upgrade to 3.0.12
|
| Ubuntu:Pro:14.04:LTS | canonical | async-http-client | All versions |
| Maven | – | org.asynchttpclient:async-http-client |
>= 3.0.0, < 3.0.12 >= 2.0.0, < 2.16.1 Fix: upgrade to 3.0.12
|
Original advisory text
AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random source
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, Realm.Builder generates the HTTP Digest client nonce with ThreadLocalRandom rather than a cryptographically secure random source. Digest relies on an unpredictable cnonce to resist chosen-plaintext and credential precomputation attacks, so an observer able to infer generator state can reduce the protection of the authentication exchange. This issue is fixed in versions 3.0.12 and 2.16.1.
References
- https://github.com/AsyncHttpClient/async-http-client/commit/dca2d90db87f0144ea89... Third Party Advisory
- https://github.com/AsyncHttpClient/async-http-client/commit/e1f5fc88fe211d3f6403... Third Party Advisory
- https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-cli... Third Party Advisory
- https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-mf... Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2026-107283 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-1072... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-107283 Vendor Advisory
- https://github.com/advisories/GHSA-mfj3-87qq-382v
- https://ubuntu.com/security/CVE-2026-107283 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-107283 Third Party Advisory
- https://github.com/AsyncHttpClient/async-http-client Product
- https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-cli... Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-338Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Timeline
Published7 Oct 2026
Updated17 Oct 2026
First seen7 Oct 2026
Sources
CVE-2026-107283 · NVD
CVE-2026-107283 · MITRE
DEBIAN-CVE-2026-107283 · OSV
CVE-2026-107283 · OSV
GHSA-mfj3-87qq-382v · GHSA
UBUNTU-CVE-2026-107283 · OSV
GHSA-mfj3-87qq-382v · OSV
Track software like this
Free during beta