CVE-2026-85718
Description
A flaw was found in AsyncHttpClient. When configured with connection limits, the library can leak a connection permit if a Transport Layer Security (TLS) handshake fails before completion. This permit leak can lead to resource exhaustion, allowing a remote attacker to cause a denial of service by repeatedly failing TLS connection establishments, thereby preventing legitimate requests from being processed.
Statement
A denial of service vulnerability was found in async-http-client, an asynchronous HTTP client library for Java. From versions 3.0.8 until 3.0.12, a client with maxConnections or maxConnectionsPerHost set above zero leaks one connection permit whenever TLS connection establishment fails before the handshake completes. Repeated TLS handshake failures can permanently exhaust the connection permit pool under a per-host limit or drain the shared pool under a global limit, blocking all future HTTP requests even when no connections remain open. This requires an application restart to recover. Red Hat products do not ship vulnerable versions of async-http-client. The issue is fixed in async-http-client 3.0.12.
Mitigation
Red Hat products are not affected by this vulnerability. No mitigation is required for Red Hat customers. For third-party Java applications using async-http-client versions 3.0.8 through 3.0.11, upgrade to version 3.0.12 or later. Alternatively, use the default unlimited connection setting, which is not affected by this vulnerability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.9 | N/A | 5.9 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
