Security1 hOctober 18, 2026, 03:40

AsyncHttpClient CVE-2026-107282 and four more flaws fixed in one batch

The Java AsyncHttpClient library patched five vulnerabilities, including cross-host request replay that leaks Authorization headers and bodies (CVE-2026-107282) and NTLM connection-pool reuse across identities (CVE-2026-107281). Fixes ship in versions 3.0.13 and 2.16.1.

DEV Community

Open source

AsyncHttpClient CVE-2026-107282 and four more flaws fixed in one batch

CVE-2026-107282: replayed requests send host A's credentials and body to host B
CVE-2026-107281: HTTP/1.1 pool key ignores the principal under NTLM/Negotiate auth
CVE-2026-107283: Digest client nonce uses ThreadLocalRandom instead of a secure source
Fixes in 3.0.13 and 2.16.1; WebSocket and proxy items in 3.0.12 and 2.16.1

#AsyncHttpClient#Java

Splunk fixes CVE-2026-76267 in REST API across three branches

Security

Floci fixes critical SSTI RCE CVE-2026-108598 in 2.2.0

Security

Gitea 28.1.0 fixes 27 flaws, including CVE-2026-103670

Security

AsyncHttpClient CVE-2026-107282 and four more flaws fixed in one batch

Splunk fixes CVE-2026-76267 in REST API across three branches

Floci fixes critical SSTI RCE CVE-2026-108598 in 2.2.0

Gitea 28.1.0 fixes 27 flaws, including CVE-2026-103670

Microsoft ships out-of-band fix for CVE-2026-96940 in Exchange Server