Bug 2547732 (CVE-2026-107284) - CVE-2026-107284 org.asynchttpclient/async-http-client: async-http-client: Processing of unverified WebSocket frames via improper handshake validation
Summary: CVE-2026-107284 org.asynchttpclient/async-http-client: async-http-client: Pro...
Keywords:
Status: NEW
Alias: CVE-2026-107284
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-10-07 21:41 UTC by OSIDB Bzimport
Modified: 2026-11-03 16:03 UTC (History)
4 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-10-07 21:41:33 UTC 
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, WebSocketHandler.upgrade aborts a handshake whose Sec-WebSocket-Accept value is missing or invalid but continues into pipeline installation and onOpen delivery. Frames coalesced with the invalid 101 response can be decoded and delivered from a peer that did not prove the handshake, although the request future fails and the channel closes. This issue is fixed in versions 3.0.12 and 2.16.1.
Note You need to log in before you can comment on or make changes to this bug.