The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. When redirect following is enabled (followRedirect(true)), versions of AsyncHttpClient prior to 3.0.9 and 2.14.5 forward Authorization and Proxy-Authorization headers along with Realm credentials to arbitrary redirect targets regardless of domain, scheme, or port changes. This leaks credentials on cross-domain redirects and HTTPS-to-HTTP downgrades. Additionally, even when stripAuthorizationOnRedirect is set to true, the Realm object containing plaintext credentials is still propagated to the redirect request, causing credential re-generation for Basic and Digest authentication schemes via NettyRequestFactory. An attacker who controls a redirect target (via open redirect, DNS rebinding, or MITM on HTTP) can capture Bearer tokens, Basic auth credentials, or any other Authorization header value. The fix in versions 3.0.9 and 2.14.5 automatically strips Authorization and Proxy-Authorization headers and clears Realm credentials whenever a redirect crosses origin boundaries (different scheme, host, or port) or downgrades from HTTPS to HTTP. For users unable to upgrade, set `(stripAuthorizationOnRedirect(true))` in the client config and avoid using Realm-based authentication with redirect following enabled. Note that `(stripAuthorizationOnRedirect(true))` alone is insufficient on versions prior to 3.0.9 and 2.14.5 because the Realm bypass still re-generates credentials. Alternatively, disable redirect following (`followRedirect(false)`) and handle redirects manually with origin validation.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and
    asynchronously process HTTP responses. When redirect following is enabled (followRedirect(true)), versions
    of AsyncHttpClient prior to 3.0.9 and 2.14.5 forward Authorization and Proxy-Authorization headers along
    with Realm credentials to arbitrary redirect targets regardless of domain, scheme, or port changes. This
    leaks credentials on cross-domain redirects and HTTPS-to-HTTP downgrades. Additionally, even when
    stripAuthorizationOnRedirect is set to true, the Realm object containing plaintext credentials is still
    propagated to the redirect request, causing credential re-generation for Basic and Digest authentication
    schemes via NettyRequestFactory. An attacker who controls a redirect target (via open redirect, DNS
    rebinding, or MITM on HTTP) can capture Bearer tokens, Basic auth credentials, or any other Authorization
    header value. The fix in versions 3.0.9 and 2.14.5 automatically strips Authorization and Proxy-
    Authorization headers and clears Realm credentials whenever a redirect crosses origin boundaries
    (different scheme, host, or port) or downgrades from HTTPS to HTTP. For users unable to upgrade, set
    `(stripAuthorizationOnRedirect(true))` in the client config and avoid using Realm-based authentication
    with redirect following enabled. Note that `(stripAuthorizationOnRedirect(true))` alone is insufficient on
    versions prior to 3.0.9 and 2.14.5 because the Realm bypass still re-generates credentials. Alternatively,
    disable redirect following (`followRedirect(false)`) and handle redirects manually with origin validation.
    (CVE-2026-40490)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and     asynchronously process HTTP responses. When redirect following is enabled (followRedirect(true)), versions     of AsyncHttpClient prior to 3.0.9 and 2.14.5 forward Authorization and Proxy-Authorization headers along     with Realm credentials to arbitrary redirect targets regardless of domain, scheme, or port changes. This     leaks credentials on cross-domain redirects and HTTPS-to-HTTP downgrades. Additionally, even when     stripAuthorizationOnRedirect is set to true, the Realm object containing plaintext credentials is still     propagated to the redirect request, causing credential re-generation for Basic and Digest authentication     schemes via NettyRequestFactory. An attacker who controls a redirect target (via open redirect, DNS     rebinding, or MITM on HTTP) can capture Bearer tokens, Basic auth credentials, or any other Authorization     header value. The fix in versions 3.0.9 and 2.14.5 automatically strips Authorization and Proxy-     Authorization headers and clears Realm credentials whenever a redirect crosses origin boundaries     (different scheme, host, or port) or downgrades from HTTPS to HTTP. For users unable to upgrade, set     `(stripAuthorizationOnRedirect(true))` in the client config and avoid using Realm-based authentication     with redirect following enabled. Note that `(stripAuthorizationOnRedirect(true))` alone is insufficient on     versions prior to 3.0.9 and 2.14.5 because the Realm bypass still re-generates credentials. Alternatively,     disable redirect following (`followRedirect(false)`) and handle redirects manually with origin validation.
    (CVE-2026-40490)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
461232	Echo: async-http-client, org.asynchttpclient:async-http-client: security update to 2.14.5	Tenable Cloud Security	Echo Local Security Checks	Local	medium
461232	Echo: async-http-client, org.asynchttpclient:async-http-client: security update to 2.14.5	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
307461	Linux Distros Unpatched Vulnerability : CVE-2026-40490	Nessus	Misc.	Local	medium
440336	SCA: security update for org.asynchttpclient:async-http-client (GHSA-cmxv-58fp-fm3g)	Tenable Cloud Security	SCA Checks	Local	medium
440336	SCA: security update for org.asynchttpclient:async-http-client (GHSA-cmxv-58fp-fm3g)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-40490

medium

Tenable Plugins

medium

medium

medium

medium

medium