The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, Realm.Builder treats a Digest challenge that yields no usable nonce as a Basic challenge. A malicious origin or proxy can label a challenge Digest while omitting or emptying the nonce, causing the client to resend the username and password using reversible Basic authentication. Both origin and proxy challenge parsers are affected. This issue is fixed in versions 3.0.13 and 2.16.1.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and
    asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, Realm.Builder treats a Digest challenge
    that yields no usable nonce as a Basic challenge. A malicious origin or proxy can label a challenge Digest
    while omitting or emptying the nonce, causing the client to resend the username and password using
    reversible Basic authentication. Both origin and proxy challenge parsers are affected. This issue is fixed
    in versions 3.0.13 and 2.16.1. (CVE-2026-107231)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and     asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, Realm.Builder treats a Digest challenge     that yields no usable nonce as a Basic challenge. A malicious origin or proxy can label a challenge Digest     while omitting or emptying the nonce, causing the client to resend the username and password using     reversible Basic authentication. Both origin and proxy challenge parsers are affected. This issue is fixed     in versions 3.0.13 and 2.16.1. (CVE-2026-107231)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
473885	SCA: security update for org.asynchttpclient:async-http-client (GHSA-rqf5-2wxv-rjf4)	Tenable Cloud Security	SCA Checks	Local	high
473885	SCA: security update for org.asynchttpclient:async-http-client (GHSA-rqf5-2wxv-rjf4)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
364250	Linux Distros Unpatched Vulnerability : CVE-2026-107231	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-107231

high

Tenable Plugins

high

high

high