Detections
Analytics

Echo: async-http-client, org.asynchttpclient:async-http-client: security update to 2.16.1

high Tenable Self-Hosted Container Security Plugin ID 459661

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and
 asynchronously process HTTP responses. From 2.0.0 until 2.16.1 and 3.0.12, automatic response
 decompression on the HTTP/1.1 path uses ChannelManager.newHttpContentDecompressor() to install
 Http1ContentDecompressor without a cumulative output-size limit. A hostile or compromised server, or an
 attacker who can alter a response in transit, can send a small gzip, deflate, or snappy response that
 expands across chunks until the client exhausts its heap and raises OutOfMemoryError; brotli and zstd are
 also affected when their optional codecs are present. In versions 3.0.8 through 3.0.10, the HTTP/2
 decompressor is also unbounded, so switching protocols does not mitigate the issue on those releases. A
 limit applied to each decode call is insufficient because the response can be delivered as many small
 chunks, so the fixed implementation tracks total decompressed bytes for the whole response. This issue is
 fixed in versions 2.16.1 and 3.0.12. (CVE-2026-85721)

Solution

Update the async-http-client library and its related packages to version 2.16.1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-85721

Plugin Details

Severity: High

ID: 459661

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/5/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.57

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2026-85721

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/28/2026

Vulnerability Publication Date: 9/17/2026

Reference Information

CVE: CVE-2026-85721