Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
3.7
CVE-2026-107284: Async Http Client may keep WebSocket connection after failed check
CVE-2026-107284 · published 11 days ago
Summary
The async-http-client library used by Java programs can continue setting up a WebSocket connection even when the security check fails. This could let unverified data be processed, potentially causing errors or unexpected behavior. Update to version 3.0.12 or later (or 2.16.1 or later) to stop the handshake after a failed check.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | asynchttpclient | async-http-client | >= 3.0.0, < 3.0.12 |
| Debian:12 | debian | async-http-client | All versions |
| Ubuntu:Pro:14.04:LTS | canonical | async-http-client | All versions |
Original advisory text
AsyncHttpClient: WebSocket handshake continues after a failed Sec-WebSocket-Accept check
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, WebSocketHandler.upgrade aborts a handshake whose Sec-WebSocket-Accept value is missing or invalid but continues into pipeline installation and onOpen delivery. Frames coalesced with the invalid 101 response can be decoded and delivered from a peer that did not prove the handshake, although the request future fails and the channel closes. This issue is fixed in versions 3.0.12 and 2.16.1.
References
- https://github.com/AsyncHttpClient/async-http-client/commit/75a278550aa9a980009d... Third Party Advisory
- https://github.com/AsyncHttpClient/async-http-client/commit/ccdcaa627db6d96dcc42... Third Party Advisory
- https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-cli... Third Party Advisory
- https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-cli... Third Party Advisory
- https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-rw... Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2026-107284 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-1072... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-107284 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-107284 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-107284 Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-345Insufficient Verification of Data Authenticity
CWE-670Always-Incorrect Control Flow Implementation
Timeline
Published7 Oct 2026
Updated17 Oct 2026
First seen7 Oct 2026
Sources
CVE-2026-107284 · NVD
CVE-2026-107284 · MITRE
DEBIAN-CVE-2026-107284 · OSV
CVE-2026-107284 · OSV
GHSA-rwhr-j9rv-85f8 · GHSA
UBUNTU-CVE-2026-107284 · OSV
Track software like this
Free during beta