CVE-2026-107284
Description
A flaw was found in async-http-client. When initiating a WebSocket connection, the client aborts handshakes that have missing or invalid validation headers but still proceeds to initialize the processing pipeline. A malicious server can exploit this issue by bundling data frames with an invalid handshake response, causing the client to decode and process untrusted messages before the connection terminates.
Déclaration
A flaw of low impact was found in the async-http-client (AsyncHttpClient/AHC) library, which Red Hat JBoss Fuse 7 ships as the async-http-client component. When an application initiates a WebSocket connection, WebSocketHandler.upgrade aborts the handshake if the server's Sec-WebSocket-Accept response header is missing or does not match the value derived from the client's Sec-WebSocket-Key, but the client still proceeds to install the WebSocket processing pipeline and deliver onOpen. A malicious or compromised server could exploit this by bundling WebSocket data frames with an invalid handshake response, causing the client to decode and deliver untrusted messages from a peer that never proved a valid handshake, even though the request fails and the channel closes. Red Hat Product Security rates this issue as Low severity (CVSS 3.1 score 3.7, vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N), matching the upstream severity rating, because exploitation requires a malicious server to win a narrow race window before the connection is torn down and the consequence is limited to low integrity impact with no effect on confidentiality or availability. Within the Red Hat portfolio, only Red Hat JBoss Fuse 7 (fuse-7-els-2 update stream) is affected; because that stream is not within full support scope, this issue is resolved there as Out of Support Scope and no Red Hat fix is planned for it.
Mesure d'atténuation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Détails du score du système commun d'évaluation des vulnérabilités (CVSS)
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
Les mesures et les scores CVSS suivants sont préliminaires et sujets à révision.
Répartition des scores CVSS v3
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Score de base | 3.7 | N/A | 3.7 |
| Vecteur d'attaque | Network | N/A | Network |
| Complexité de l'attaque | High | N/A | High |
| Privilèges requis | None | N/A | None |
| Interaction avec l'utilisateur | None | N/A | None |
| Champ d'application | Unchanged | N/A | Unchanged |
| Confidentialité | None | N/A | None |
| Impact sur l'intégrité | Low | N/A | Low |
| Impact sur la disponibilité | None | N/A | None |
Vecteur
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
cve.org: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Comprendre la Défaillance (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism
Questions fréquemment posées
Not sure what something means? Check out our Security Glossary.
Vous souhaitez recevoir des notifications d'errata ? Signez ici.
