CVE-2026-107279

AsyncHttpClient: Digest mutual authentication is switched off by a peer offering qop=auth-int

State: Published
Severity: 8.8 High
Published: Oct 7, 2026
Updated: Oct 8, 2026
Reserved: Oct 7, 2026

Description

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. In 3.0.12, a peer offering only Digest qop=auth-int causes mutual-authentication verification to be skipped. AuthenticatorUtils.computeExpectedRspAuth returns no expected value for auth-int, and Interceptors treats that result as unverifiable but nonfatal, so a response with an invalid rspauth value is accepted. A peer that does not know the shared secret can therefore be accepted as the authenticated server. This issue is fixed in version 3.0.13.

Scores

CVSS	Score	Vector	Source
4.0	8.8 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N	GitHub_M

Weaknesses

CWE-303 Incorrect Implementation of Authentication Algorithm
CWE-757 Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')

Affected Products

Product	Versions
async-http-clientAsyncHttpClient	= 3.0.12Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.