CVE-2026-85720: 
Java vulnerability analysis and mitigation

CVE-2026-85720 is a credential exposure vulnerability in the AsyncHttpClient (AHC) Java library, where origin authentication credentials are transmitted in cleartext to an HTTP proxy during CONNECT tunnel establishment. Affected versions include 2.0.0 through 2.16.0 (2.x line) and 3.0.0 through 3.0.11 (3.x line). The vulnerability was discovered by hyperxpro, with a fix merged on July 4, 2026, and the advisory published on August 9, 2026, with the CVE formally assigned on September 17, 2026. It carries a CVSS v3.1 base score of 5.9 (Medium) (Github Advisory).

The root cause lies in two code paths within the Netty-based request layer: NettyRequestFactory.newNettyRequest() unconditionally called addAuthorizationHeader() for every request it built — including the plaintext HTTP CONNECT used to open a proxy tunnel — and NettyRequestSender.sendRequestWithNewChannel() similarly attached per-connection NTLM, Kerberos, or SPNEGO tokens via perConnectionAuthorizationHeader() to the CONNECT request without checking the request method (CWE-319, CWE-522). Because the CONNECT is sent to the proxy before any TLS tunnel exists, Basic (Authorization: Basic base64(user:pass)), Digest, NTLM, SPNEGO, and Kerberos credentials intended solely for the HTTPS origin are exposed in plaintext to the proxy and any on-path observer of the client-to-proxy hop. The fix gates both code paths on the request not being a CONNECT, so credentials are only attached to the tunneled request built after the tunnel is established (Github Advisory, Fix Commit).

Successful exploitation results in high confidentiality impact: origin credentials (Basic, Digest, NTLM, Kerberos, or SPNEGO tokens) are exposed to the HTTP proxy operator and any network observer positioned on the client-to-proxy segment. Stolen credentials could be replayed to authenticate directly against the HTTPS origin service, enabling unauthorized access, data exfiltration, or lateral movement within the target environment. There is no integrity or availability impact from the vulnerability itself, but compromised credentials may enable further attacks (Github Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the advisory date. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a network-adjacent or on-path position between the AHC client and its configured HTTP proxy (high attack complexity), but no privileges or user interaction are needed. The vulnerability is passive — an attacker controlling or monitoring the proxy, or positioned on the client-to-proxy network segment, can capture credentials without any active interaction with the victim application (Github Advisory).

1. Identify target: Locate a Java application using AsyncHttpClient (versions 2.0.0–2.16.0 or 3.0.0–3.0.11) that is configured to use preemptive authentication (Basic, Digest, NTLM, Kerberos, or SPNEGO) when connecting to HTTPS origins through an HTTP proxy.
2. Position on network: Gain access to the client-to-proxy network segment (e.g., via ARP spoofing, rogue proxy, compromised network device, or control of the proxy itself) to observe plaintext HTTP traffic.
3. Capture CONNECT request: Intercept the HTTP CONNECT request sent by the AHC client to the proxy. Because the library attaches the Authorization header to this plaintext CONNECT before TLS is established, the header is visible in cleartext (e.g., Authorization: Basic dXNlcjpwYXNz for Basic auth, or an NTLM/Kerberos token for those schemes).
4. Extract credentials: Decode the captured Authorization header value (e.g., Base64-decode Basic credentials, or extract the NTLM/Kerberos token for offline cracking or relay attacks).
5. Replay or crack credentials: Use the extracted credentials to authenticate directly against the HTTPS origin service, or relay NTLM/Kerberos tokens to impersonate the victim user against other services (Github Advisory, Fix PR).

• Network: Plaintext HTTP CONNECT requests to a proxy server containing an Authorization header (e.g., Authorization: Basic ..., Authorization: NTLM ..., or Authorization: Negotiate ...) — this header should never appear on a CONNECT in patched versions.
• Logs: Proxy access logs recording CONNECT requests with an Authorization header field from AHC-based clients; unexpected authentication attempts against origin services from IP addresses associated with the proxy rather than the client.
• Process/Application: Java applications using org.asynchttpclient:async-http-client versions prior to 2.16.1 or 3.0.12 that are configured with preemptive authentication realms and an HTTP proxy — identifiable via dependency manifests (pom.xml, build.gradle) or runtime classpath inspection.

Upgrade to AsyncHttpClient version 2.16.1 (2.x line) or 3.0.12 (3.x line) to resolve this vulnerability. Note that version 3.0.12 is itself affected by a separate Digest-downgrade issue (GHSA-rqf5-2wxv-rjf4); users on the 3.x line should upgrade to 3.0.13 to address both issues. As a workaround where upgrading is not immediately possible, disable preemptive origin authentication when routing through an HTTP proxy, or configure the application to reach the HTTPS origin directly without a CONNECT proxy (Github Advisory).