CVE-2026-107230

{
  "etk_id": "ETK-2026-957",
  "cve_id": "CVE-2026-107230",
  "display_id": "CVE-2026-107230",
  "ghsa_id": "GHSA-v2j5-22fr-j62r",
  "euvd_id": "EUVD-2026-94635",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Cross-identity connection reuse in async-http-client",
  "summary": "Affected async-http-client releases can associate a later request with credentials established by another caller through a reused connection. This requires one client instance to send traffic to the same destination or proxy under multiple identities, or to mix credentialed and uncredentialed requests with the affected authentication paths.",
  "mitigation": "Upgrade org.asynchttpclient:async-http-client to 3.0.14. Until upgraded, isolate each identity in a separate AsyncHttpClient instance or disable connection pooling.",
  "vendor": "maven",
  "product": "maven:org.asynchttpclient:async-http-client",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 3.0.0, <= 3.0.13"
      ],
      "ecosystem": "maven",
      "fixed_versions": [
        "3.0.14"
      ],
      "package_name": "org.asynchttpclient:async-http-client",
      "purl": "pkg:maven/org.asynchttpclient/async-http-client"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 2.0.0, <= 2.16.1"
      ],
      "ecosystem": "maven",
      "fixed_versions": [],
      "package_name": "org.asynchttpclient:async-http-client",
      "purl": "pkg:maven/org.asynchttpclient/async-http-client"
    }
  ],
  "cwes": [
    346
  ],
  "cvss_score": 7.4,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
  "epss_score": 0.0019,
  "epss_percentile": 0.0793,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "mechanism_verified",
  "exploit": false,
  "pipeline_minutes": 19.343143566666665,
  "t0_at": "2026-10-07T21:00:47.997000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-08T09:13:19.071688+00:00",
      "days": 0.5086929940740741,
      "is_lower_bound": false,
      "measured_at": "2026-10-07T21:00:47.997000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-07T21:00:47.997000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-07T21:00:47.997000+00:00",
      "url": "https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-v2j5-22fr-j62r"
    }
  }
}