The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.14.5 to 2.16.0 and from 3.0.9 to 3.0.11, a client configured with a client-wide Realm and redirect following can disclose credentials after a cross-origin redirect because the Interceptors authentication path falls back to the client configuration after redirect handling clears the per-exchange realm. If the attacker-controlled target returns 401, the client can send Basic or Digest credentials or a Negotiate or NTLM token to that origin. Per-request realms are stripped correctly, and this issue is a residual bypass of the earlier cross-origin credential-stripping fixes. This issue is fixed in versions 2.16.1 and 3.0.12.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and
    asynchronously process HTTP responses. From 2.14.5 to 2.16.0 and from 3.0.9 to 3.0.11, a client configured
    with a client-wide Realm and redirect following can disclose credentials after a cross-origin redirect
    because the Interceptors authentication path falls back to the client configuration after redirect
    handling clears the per-exchange realm. If the attacker-controlled target returns 401, the client can send
    Basic or Digest credentials or a Negotiate or NTLM token to that origin. Per-request realms are stripped
    correctly, and this issue is a residual bypass of the earlier cross-origin credential-stripping fixes.
    This issue is fixed in versions 2.16.1 and 3.0.12. (CVE-2026-85717)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and     asynchronously process HTTP responses. From 2.14.5 to 2.16.0 and from 3.0.9 to 3.0.11, a client configured     with a client-wide Realm and redirect following can disclose credentials after a cross-origin redirect     because the Interceptors authentication path falls back to the client configuration after redirect     handling clears the per-exchange realm. If the attacker-controlled target returns 401, the client can send     Basic or Digest credentials or a Negotiate or NTLM token to that origin. Per-request realms are stripped     correctly, and this issue is a residual bypass of the earlier cross-origin credential-stripping fixes.
    This issue is fixed in versions 2.16.1 and 3.0.12. (CVE-2026-85717)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
457248	Echo: async-http-client, org.asynchttpclient:async-http-client: security update to 2.16.1	Tenable Cloud Security	Echo Local Security Checks	Local	medium
457248	Echo: async-http-client, org.asynchttpclient:async-http-client: security update to 2.16.1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
348704	Linux Distros Unpatched Vulnerability : CVE-2026-85717	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-85717

medium

Tenable Plugins

medium

medium

medium