The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 and 3.0.12, automatic response decompression on the HTTP/1.1 path uses ChannelManager.newHttpContentDecompressor() to install Http1ContentDecompressor without a cumulative output-size limit. A hostile or compromised server, or an attacker who can alter a response in transit, can send a small gzip, deflate, or snappy response that expands across chunks until the client exhausts its heap and raises OutOfMemoryError; brotli and zstd are also affected when their optional codecs are present. In versions 3.0.8 through 3.0.10, the HTTP/2 decompressor is also unbounded, so switching protocols does not mitigate the issue on those releases. A limit applied to each decode call is insufficient because the response can be delivered as many small chunks, so the fixed implementation tracks total decompressed bytes for the whole response. This issue is fixed in versions 2.16.1 and 3.0.12.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and
    asynchronously process HTTP responses. From 2.0.0 until 2.16.1 and 3.0.12, automatic response
    decompression on the HTTP/1.1 path uses ChannelManager.newHttpContentDecompressor() to install
    Http1ContentDecompressor without a cumulative output-size limit. A hostile or compromised server, or an
    attacker who can alter a response in transit, can send a small gzip, deflate, or snappy response that
    expands across chunks until the client exhausts its heap and raises OutOfMemoryError; brotli and zstd are
    also affected when their optional codecs are present. In versions 3.0.8 through 3.0.10, the HTTP/2
    decompressor is also unbounded, so switching protocols does not mitigate the issue on those releases. A
    limit applied to each decode call is insufficient because the response can be delivered as many small
    chunks, so the fixed implementation tracks total decompressed bytes for the whole response. This issue is
    fixed in versions 2.16.1 and 3.0.12. (CVE-2026-85721)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and     asynchronously process HTTP responses. From 2.0.0 until 2.16.1 and 3.0.12, automatic response     decompression on the HTTP/1.1 path uses ChannelManager.newHttpContentDecompressor() to install     Http1ContentDecompressor without a cumulative output-size limit. A hostile or compromised server, or an     attacker who can alter a response in transit, can send a small gzip, deflate, or snappy response that     expands across chunks until the client exhausts its heap and raises OutOfMemoryError; brotli and zstd are     also affected when their optional codecs are present. In versions 3.0.8 through 3.0.10, the HTTP/2     decompressor is also unbounded, so switching protocols does not mitigate the issue on those releases. A     limit applied to each decode call is insufficient because the response can be delivered as many small     chunks, so the fixed implementation tracks total decompressed bytes for the whole response. This issue is     fixed in versions 2.16.1 and 3.0.12. (CVE-2026-85721)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
459661	Echo: async-http-client, org.asynchttpclient:async-http-client: security update to 2.16.1	Tenable Cloud Security	Echo Local Security Checks	Local	high
459661	Echo: async-http-client, org.asynchttpclient:async-http-client: security update to 2.16.1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
348324	Linux Distros Unpatched Vulnerability : CVE-2026-85721	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-85721

high

Tenable Plugins

high

high

high