CVE-2026-107285
Description
A flaw was found in async-http-client. When establishing a proxied WebSocket connection through an HTTP tunnel, the client improperly includes proxy authentication headers in the request sent to the destination server. A remote origin server can capture these credentials, leading to information disclosure and potential unauthorized proxy access.
Statement
A flaw of MODERATE severity was found in the AsyncHttpClient (async-http-client) Java library, which Red Hat ships only as a dependency of Red Hat JBoss Fuse 7 (delivered via the out-of-support-scope fuse-7-els-2 stream). When a client opens a plain WebSocket (ws://) connection through an HTTP proxy that requires authentication, the connection is tunneled using HTTP CONNECT, but the WebSocket upgrade request sent through the tunnel incorrectly carries the proxy's Proxy-Authorization header, which is intended only for the proxy. The destination (origin) server, or an attacker positioned on the origin side of the connection, can capture these credentials: Basic authentication credentials are directly recoverable, while Digest authentication responses can be replayed or cracked offline, leading to information disclosure and potential unauthorized access to the proxy. Exploitation requires an application that routes ws:// WebSocket traffic through an authenticated HTTP proxy to an untrusted destination, which is why the Red Hat severity is MODERATE (CVSS 5.9, matching the upstream rating). Because the only affected Red Hat delivery, the fuse-7-els-2 stream of JBoss Fuse 7, is out of support scope, no fix is planned for it.
Mitigation
A workaround is available: do not use proxy authentication together with ws:// requests through an HTTP proxy, or use wss:// (TLS-secured WebSocket) connections instead, so that the proxy credentials are not attached to the tunneled request. Upgrading to a fixed upstream release also resolves the issue: the upstream project fixed the flaw in async-http-client 3.0.12 on the 3.x line and 2.16.1 on the 2.x line, and the upstream advisory recommends 3.0.13 on the 3.x line to also pick up the fix for a separate Digest-downgrade issue affecting 3.0.12. Because the only affected Red Hat delivery, JBoss Fuse 7 via the fuse-7-els-2 stream, is out of support scope, no updated Red Hat package is planned for that stream; users of affected deployments should apply the workaround above.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.9 | N/A | 5.9 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | None | N/A | None |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
cve.org: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Files or Directories; Read Memory; Read Application Data
Sensitive data may be exposed to attackers.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
