CVE-2026-107285: 
Java vulnerability analysis and mitigation

CVE-2026-107285 is a credential disclosure vulnerability in the AsyncHttpClient (AHC) Java library, where proxy authentication credentials are incorrectly leaked to origin servers during WebSocket (ws://) connections tunneled through an HTTP proxy via CONNECT. It affects AHC versions >= 2.0.0 and < 2.16.1 (2.x branch) and >= 3.0.0 and < 3.0.12 (3.x branch). The vulnerability was published on October 7, 2026, and patches were released on August 9, 2026. It carries a CVSS v3.1 base score of 5.9 (Medium) (GitHub Advisory).

The root cause lies in a logic flaw in NettyRequestFactory.newNettyRequest() and the companion requestUri() method (CWE-319, CWE-522): both functions determined whether to attach a Proxy-Authorization header and use an absolute-form request target solely by checking uri.isSecured(), which returns false for ws:// URIs. However, NettyRequestSender.needConnect() already correctly tunnels ws:// through HTTP CONNECT — just as it does for https:// and wss:// — meaning the subsequent WebSocket upgrade request travels through the established tunnel directly to the origin server, not to the proxy. Because the proxy-auth gate did not exclude WebSocket URIs, the tunneled upgrade request incorrectly included the Proxy-Authorization header and an absolute-form target intended only for the proxy. Basic authentication credentials are directly readable from the header, while Digest authentication responses can be replayed or cracked offline (GitHub Advisory, Fix Commit 3.x, Fix Commit 2.x).

Successful exploitation allows an attacker positioned on the origin-server side of the network — or a malicious/compromised origin server itself — to capture proxy authentication credentials from the Proxy-Authorization header included in the WebSocket upgrade request. Basic credentials are immediately recoverable in plaintext, while Digest credentials can be replayed against the proxy or subjected to offline cracking. The impact is limited to confidentiality (no integrity or availability impact), but compromised proxy credentials could enable unauthorized proxy access, lateral movement through the network, or further credential abuse (GitHub Advisory).

No public proof-of-concept exploit code is known, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a network-adjacent or origin-server position (attack complexity: High), and the EPSS score is approximately 0.206%, indicating low near-term exploitation probability. NVD SSVC assessment classifies exploitation as "none" and the attack as non-automatable.

1. Identify a target application: Locate a Java application using AsyncHttpClient (AHC) versions 2.0.0–2.16.0 or 3.0.0–3.0.11 that makes ws:// WebSocket connections through an HTTP proxy configured with Basic or Digest authentication.
2. Position on the origin-server side: Gain a network vantage point between the proxy tunnel exit and the origin server (e.g., control the origin server, perform ARP spoofing on the origin-side network segment, or operate a malicious WebSocket endpoint).
3. Trigger a proxied WebSocket connection: Wait for or induce the vulnerable AHC client to initiate a ws:// WebSocket request through the authenticated HTTP proxy. The client will send an HTTP CONNECT to the proxy to establish the tunnel.
4. Capture the WebSocket upgrade request: Once the CONNECT tunnel is established, observe the WebSocket upgrade HTTP request forwarded through the tunnel to the origin. Due to the bug, this request will contain the Proxy-Authorization header with the proxy credentials.
5. Extract credentials: For Basic authentication, base64-decode the Proxy-Authorization: Basic <token> value to recover the plaintext username:password. For Digest authentication, capture the response and replay it against the proxy or submit it to an offline cracking tool (e.g., Hashcat) to recover the password (GitHub Advisory).

• Network: Unexpected Proxy-Authorization headers present in WebSocket upgrade requests (HTTP GET with Upgrade: websocket) observed at the origin server or on the origin-side network segment; absolute-form request targets (e.g., ws://proxy.example.com/path) in WebSocket upgrade requests rather than origin-form paths.
• Logs: Origin server access logs showing WebSocket upgrade requests (GET ws://... HTTP/1.1) containing Proxy-Authorization header values; proxy logs showing CONNECT tunnels established for ws:// destinations followed by no further proxy-level authentication activity from the origin side.
• Application Behavior: Java applications using AHC making ws:// connections through an authenticated HTTP proxy on affected versions (2.0.0–2.16.0 or 3.0.0–3.0.11) should be treated as potentially having exposed proxy credentials.

Upgrade AsyncHttpClient to version 3.0.12 (3.x branch) or 2.16.1 (2.x branch), which fix the issue by excluding WebSocket URIs from the proxy-auth header attachment and absolute-form target selection logic, mirroring the existing handling of wss:// (AHC 2.16.1 Release, AHC 3.0.12 Release). Note that 3.0.12 itself contains a separate Digest downgrade issue (GHSA-rqf5-2wxv-rjf4); users on the 3.x branch should upgrade to 3.0.13 or later to address both issues. If immediate patching is not possible, avoid using proxy authentication together with ws:// connections — use wss:// instead, or implement network-level controls (e.g., IP allowlisting) to restrict access to the proxy and origin servers (GitHub Advisory).