The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, Realm.Builder generates the HTTP Digest client nonce with ThreadLocalRandom rather than a cryptographically secure random source. Digest relies on an unpredictable cnonce to resist chosen-plaintext and credential precomputation attacks, so an observer able to infer generator state can reduce the protection of the authentication exchange. This issue is fixed in versions 3.0.12 and 2.16.1.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and
    asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, Realm.Builder generates the HTTP Digest
    client nonce with ThreadLocalRandom rather than a cryptographically secure random source. Digest relies on
    an unpredictable cnonce to resist chosen-plaintext and credential precomputation attacks, so an observer
    able to infer generator state can reduce the protection of the authentication exchange. This issue is
    fixed in versions 3.0.12 and 2.16.1. (CVE-2026-107283)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and     asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, Realm.Builder generates the HTTP Digest     client nonce with ThreadLocalRandom rather than a cryptographically secure random source. Digest relies on     an unpredictable cnonce to resist chosen-plaintext and credential precomputation attacks, so an observer     able to infer generator state can reduce the protection of the authentication exchange. This issue is     fixed in versions 3.0.12 and 2.16.1. (CVE-2026-107283)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
474129	Echo: org.asynchttpclient:async-http-client: security update to 2.16.1	Tenable Cloud Security	Echo Local Security Checks	Local	low
474129	Echo: org.asynchttpclient:async-http-client: security update to 2.16.1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	low
473898	SCA: security update for org.asynchttpclient:async-http-client (GHSA-mfj3-87qq-382v)	Tenable Cloud Security	SCA Checks	Local	low
473898	SCA: security update for org.asynchttpclient:async-http-client (GHSA-mfj3-87qq-382v)	Tenable Self-Hosted Container Security	SCA Checks	Local	low
364276	Linux Distros Unpatched Vulnerability : CVE-2026-107283	Nessus	Misc.	Local	low

Detections

Analytics

CVE-2026-107283

low

Tenable Plugins

low

low

low

low

low