CVE-2026-85719
Description
A flaw was found in AsyncHttpClient. This vulnerability allows an attacker to expose SOCKS proxy credentials to the origin server when using an authenticated SOCKS proxy. This occurs because the library attaches Proxy-Authorization headers without verifying if the request is being sent to an HTTP proxy. Depending on the authentication flow, this can lead to the disclosure of sensitive credentials, such as Basic, NTLM, Kerberos, or SPNEGO, to a potentially hostile origin server.
Statement
An IMPORTANT severity information-disclosure flaw was found in the AsyncHttpClient (AHC) Java library, which Red Hat tracks for Red Hat JBoss Fuse 7 as the async-http-client component. When AsyncHttpClient sends a request through an authenticated SOCKS proxy, NettyRequestFactory and NettyRequestSender attach a Proxy-Authorization header without confirming that the request is being sent to an HTTP proxy. With preemptive proxy authentication, credentials such as directly reversible Basic credentials are attached to a plaintext HTTP request and exposed to the origin server. With the default non-preemptive flow, a hostile origin server can return a 407 response, causing ProxyUnauthorized407Interceptor to send proxy credentials, including NTLM, Kerberos, and SPNEGO credentials, through the existing SOCKS tunnel. A remote attacker able to control the origin server could therefore obtain the victim's SOCKS proxy authentication credentials. Red Hat rates this flaw IMPORTANT with CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), matching the upstream CVEORG severity. The only Red Hat affect is for Red Hat JBoss Fuse 7: the assessment of the async-http-client component was delegated to the product team, which concluded the product is not affected because the component is not present in the shipped product, so no Red Hat product fix is required.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | 7.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | None | N/A | None |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Files or Directories; Read Memory; Read Application Data
Sensitive data may be exposed to attackers.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
