Detections
Analytics

SCA: security update for org.asynchttpclient:async-http-client (GHSA-cmxv-58fp-fm3g)

medium Tenable Self-Hosted Container Security Plugin ID 440336

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and
 asynchronously process HTTP responses. When redirect following is enabled (followRedirect(true)), versions
 of AsyncHttpClient prior to 3.0.9 and 2.14.5 forward Authorization and Proxy-Authorization headers along
 with Realm credentials to arbitrary redirect targets regardless of domain, scheme, or port changes. This
 leaks credentials on cross-domain redirects and HTTPS-to-HTTP downgrades. Additionally, even when
 stripAuthorizationOnRedirect is set to true, the Realm object containing plaintext credentials is still
 propagated to the redirect request, causing credential re-generation for Basic and Digest authentication
 schemes via NettyRequestFactory. An attacker who controls a redirect target (via open redirect, DNS
 rebinding, or MITM on HTTP) can capture Bearer tokens, Basic auth credentials, or any other Authorization
 header value. The fix in versions 3.0.9 and 2.14.5 automatically strips Authorization and Proxy-
 Authorization headers and clears Realm credentials whenever a redirect crosses origin boundaries
 (different scheme, host, or port) or downgrades from HTTPS to HTTP. For users unable to upgrade, set
 `(stripAuthorizationOnRedirect(true))` in the client config and avoid using Realm-based authentication
 with redirect following enabled. Note that `(stripAuthorizationOnRedirect(true))` alone is insufficient on
 versions prior to 3.0.9 and 2.14.5 because the Realm bypass still re-generates credentials. Alternatively,
 disable redirect following (`followRedirect(false)`) and handle redirects manually with origin validation.
 (CVE-2026-40490)

Solution

Update the org.asynchttpclient:async-http-client library and its related packages to version 3.0.9 or later.

See Also

https://github.com/advisories/GHSA-cmxv-58fp-fm3g

Plugin Details

Severity: Medium

ID: 440336

Version: Revision 1.7

Type: Local

Family: SCA Checks

Published: 4/14/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3.3

Percentile: 51.27

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 5.4

Temporal Score: 4

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:N/A:N

CVSS Score Source: CVE-2026-40490

CVSS v3

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5.9

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 4/14/2026

Vulnerability Publication Date: 4/14/2026

Reference Information

CVE: CVE-2026-40490

cwe: CWE-200