CVE-2026-107283
Description
A flaw was found in AsyncHttpClient. This vulnerability can weaken authentication security because the Realm.Builder component generates HTTP Digest client nonces—unique values used to protect against replay and precomputation attacks—using an insecure random number generator instead of a cryptographically secure source. A remote network attacker who observes authentication exchanges may infer the internal generator state, lowering the security of the exchange and potentially facilitating credential attacks.
Statement
A low impact flaw was found in the AsyncHttpClient (async-http-client) library, which is included in Red Hat JBoss Fuse 7. The Realm.Builder component generates the HTTP Digest client nonce (cnonce) using ThreadLocalRandom, a non-cryptographic pseudorandom number generator, instead of a cryptographically secure random source. HTTP Digest authentication relies on an unpredictable cnonce to resist chosen-plaintext and credential precomputation attacks, so a remote network attacker who can observe authentication exchanges and infer the internal state of the random number generator could reduce the protection of the exchange and potentially facilitate credential attacks. Red Hat rates this flaw Low severity, consistent with the upstream rating (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N). Within the Red Hat portfolio, the affected async-http-client component ships in Red Hat JBoss Fuse 7 through the fuse-7-els-2 update stream. Because that stream is out of full support scope and the impact is Low, the flaw is recorded as out of support scope and no fix is planned for it; the residual risk is the weakened protection of HTTP Digest authentication exchanges described above. No other Red Hat products are currently listed as affected.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 3.7 | N/A | 3.7 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | Low | N/A | Low |
| Integrity Impact | None | N/A | None |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
cve.org: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism
If a PRNG is used for authentication and authorization, such as a session ID or a seed for generating a cryptographic key, then an attacker may be able to easily guess the ID or cryptographic key and gain access to restricted functionality.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
