The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 3.0.14, connection-pool partitioning still omits identity-defining fields for Kerberos, SPNEGO, NTLM, and authenticated proxy connections. Logins without a configured principal, proxy realms, identities sharing a user name, and SOCKS or CONNECT proxy logins can reuse a socket authenticated as a different identity. A later request is then executed under the first identity and can expose that identity's data or authority to another caller. In the affected execution path, SpnegoEngine, NTLM, Kerberos, SPNEGO, SOCKS, and CONNECT control or expose the vulnerable behavior. This issue is fixed in version 3.0.14.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and
    asynchronously process HTTP responses. From 2.0.0 until 3.0.14, connection-pool partitioning still omits
    identity-defining fields for Kerberos, SPNEGO, NTLM, and authenticated proxy connections. Logins without a
    configured principal, proxy realms, identities sharing a user name, and SOCKS or CONNECT proxy logins can
    reuse a socket authenticated as a different identity. A later request is then executed under the first
    identity and can expose that identity's data or authority to another caller. In the affected execution
    path, SpnegoEngine, NTLM, Kerberos, SPNEGO, SOCKS, and CONNECT control or expose the vulnerable behavior.
    This issue is fixed in version 3.0.14. (CVE-2026-107230)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and     asynchronously process HTTP responses. From 2.0.0 until 3.0.14, connection-pool partitioning still omits     identity-defining fields for Kerberos, SPNEGO, NTLM, and authenticated proxy connections. Logins without a     configured principal, proxy realms, identities sharing a user name, and SOCKS or CONNECT proxy logins can     reuse a socket authenticated as a different identity. A later request is then executed under the first     identity and can expose that identity's data or authority to another caller. In the affected execution     path, SpnegoEngine, NTLM, Kerberos, SPNEGO, SOCKS, and CONNECT control or expose the vulnerable behavior.
    This issue is fixed in version 3.0.14. (CVE-2026-107230)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
474204	Chainguard: multiple druid packages: security update to 38.0.0-r4	Tenable Cloud Security	Chainguard Local Security Checks	Local	high
474204	Chainguard: multiple druid packages: security update to 38.0.0-r4	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	Local	high
473879	SCA: security update for org.asynchttpclient:async-http-client (GHSA-v2j5-22fr-j62r)	Tenable Cloud Security	SCA Checks	Local	high
473879	SCA: security update for org.asynchttpclient:async-http-client (GHSA-v2j5-22fr-j62r)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
364226	Linux Distros Unpatched Vulnerability : CVE-2026-107230	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-107230

high

Tenable Plugins

high

high

high

high

high