CVE-2026-107232

Summary

The AsyncHttpClient library incorrectly handles HTTP proxy connections by inferring tunnel existence from the last request method instead of the CONNECT result. This allows attackers to send authentication credentials over plaintext proxy connections even when the proxy rejects the CONNECT request, potentially exposing sensitive credentials.

Exploitability

Exploitation requires a man-in-the-middle position between a client and a proxy server, with the client using AsyncHttpClient library versions prior to 3.0.12 or 2.16.1, making it moderately difficult but possible to achieve.

Blast radius

The impact could be significant across any Java application using AsyncHttpClient with proxy configurations, potentially exposing Basic authentication credentials and enabling NTLM relay attacks.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to AsyncHttpClient versions 3.0.12 or 2.16.1 immediately.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.