CVE-2026-85718

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-85718", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-09-04T14:45:10.648Z", "datePublished": "2026-09-17T15:58:40.719Z", "dateUpdated": "2026-09-17T16:40:07.831Z"}, "containers": {"cna": {"title": "AsyncHttpClient: Connection permit leak on TLS handshake failure causes per-host denial of service", "problemTypes": [{"descriptions": [{"cweId": "CWE-400", "lang": "en", "description": "CWE-400: Uncontrolled Resource Consumption", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-772", "lang": "en", "description": "CWE-772: Missing Release of Resource after Effective Lifetime", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-gcmv-gr82-6m8v", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-gcmv-gr82-6m8v"}, {"name": "https://github.com/AsyncHttpClient/async-http-client/issues/2189", "tags": ["x_refsource_MISC"], "url": "https://github.com/AsyncHttpClient/async-http-client/issues/2189"}, {"name": "https://github.com/AsyncHttpClient/async-http-client/pull/2288", "tags": ["x_refsource_MISC"], "url": "https://github.com/AsyncHttpClient/async-http-client/pull/2288"}, {"name": "https://github.com/AsyncHttpClient/async-http-client/commit/64eb57af52a003ae7f29a2f9f4502271bbb138dd", "tags": ["x_refsource_MISC"], "url": "https://github.com/AsyncHttpClient/async-http-client/commit/64eb57af52a003ae7f29a2f9f4502271bbb138dd"}], "affected": [{"vendor": "AsyncHttpClient", "product": "async-http-client", "versions": [{"version": ">= 3.0.8, < 3.0.12", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-09-17T15:58:40.719Z"}, "descriptions": [{"lang": "en", "value": "The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 3.0.8 until 3.0.12, a client with maxConnections or maxConnectionsPerHost set above zero leaks one connection permit whenever TLS connection establishment fails before the handshake completes. NettyConnectListener removes the partitionKeyLock permit from NettyResponseFuture before every failure path is bound to the channel closeFuture, so an abort can leave the permit unreleased. Repeated failures can permanently lock out one host under a per-host limit or drain the shared pool under a global limit, blocking later requests even when no connection remains open. The default unlimited connection setting is not affected. This issue is fixed in version 3.0.12."}], "source": {"advisory": "GHSA-gcmv-gr82-6m8v", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-17T16:39:56.605072Z", "id": "CVE-2026-85718", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-17T16:40:07.831Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-85718", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-09-04T14:45:10.648Z", "datePublished": "2026-09-17T15:58:40.719Z", "dateUpdated": "2026-09-17T16:40:07.831Z"}, "containers": {"cna": {"title": "AsyncHttpClient: Connection permit leak on TLS handshake failure causes per-host denial of service", "problemTypes": [{"descriptions": [{"cweId": "CWE-400", "lang": "en", "description": "CWE-400: Uncontrolled Resource Consumption", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-772", "lang": "en", "description": "CWE-772: Missing Release of Resource after Effective Lifetime", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-gcmv-gr82-6m8v", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-gcmv-gr82-6m8v"}, {"name": "https://github.com/AsyncHttpClient/async-http-client/issues/2189", "tags": ["x_refsource_MISC"], "url": "https://github.com/AsyncHttpClient/async-http-client/issues/2189"}, {"name": "https://github.com/AsyncHttpClient/async-http-client/pull/2288", "tags": ["x_refsource_MISC"], "url": "https://github.com/AsyncHttpClient/async-http-client/pull/2288"}, {"name": "https://github.com/AsyncHttpClient/async-http-client/commit/64eb57af52a003ae7f29a2f9f4502271bbb138dd", "tags": ["x_refsource_MISC"], "url": "https://github.com/AsyncHttpClient/async-http-client/commit/64eb57af52a003ae7f29a2f9f4502271bbb138dd"}], "affected": [{"vendor": "AsyncHttpClient", "product": "async-http-client", "versions": [{"version": ">= 3.0.8, < 3.0.12", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-09-17T15:58:40.719Z"}, "descriptions": [{"lang": "en", "value": "The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 3.0.8 until 3.0.12, a client with maxConnections or maxConnectionsPerHost set above zero leaks one connection permit whenever TLS connection establishment fails before the handshake completes. NettyConnectListener removes the partitionKeyLock permit from NettyResponseFuture before every failure path is bound to the channel closeFuture, so an abort can leave the permit unreleased. Repeated failures can permanently lock out one host under a per-host limit or drain the shared pool under a global limit, blocking later requests even when no connection remains open. The default unlimited connection setting is not affected. This issue is fixed in version 3.0.12."}], "source": {"advisory": "GHSA-gcmv-gr82-6m8v", "discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-85718", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-17T16:39:56.605072Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-17T16:40:01.509Z"}}]}}

{"affected": [{"affectedData": [{"product": "async-http-client", "vendor": "AsyncHttpClient", "versions": [{"status": "affected", "version": ">= 3.0.8, < 3.0.12"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 3.0.8 until 3.0.12, a client with maxConnections or maxConnectionsPerHost set above zero leaks one connection permit whenever TLS connection establishment fails before the handshake completes. NettyConnectListener removes the partitionKeyLock permit from NettyResponseFuture before every failure path is bound to the channel closeFuture, so an abort can leave the permit unreleased. Repeated failures can permanently lock out one host under a per-host limit or drain the shared pool under a global limit, blocking later requests even when no connection remains open. The default unlimited connection setting is not affected. This issue is fixed in version 3.0.12."}], "id": "CVE-2026-85718", "lastModified": "2026-09-30T17:43:24.057", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-85718", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-17T16:39:56.605072Z", "version": "2.0.3"}}]}, "published": "2026-09-17T16:18:16.113", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/AsyncHttpClient/async-http-client/commit/64eb57af52a003ae7f29a2f9f4502271bbb138dd"}, {"source": "security-advisories@github.com", "url": "https://github.com/AsyncHttpClient/async-http-client/issues/2189"}, {"source": "security-advisories@github.com", "url": "https://github.com/AsyncHttpClient/async-http-client/pull/2288"}, {"source": "security-advisories@github.com", "url": "https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-gcmv-gr82-6m8v"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}, {"lang": "en", "value": "CWE-772"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "org.asynchttpclient/async-http-client: AsyncHttpClient: Denial of Service via TLS handshake failure", "id": "2536137", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536137"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-772", "details": ["The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 3.0.8 until 3.0.12, a client with maxConnections or maxConnectionsPerHost set above zero leaks one connection permit whenever TLS connection establishment fails before the handshake completes. NettyConnectListener removes the partitionKeyLock permit from NettyResponseFuture before every failure path is bound to the channel closeFuture, so an abort can leave the permit unreleased. Repeated failures can permanently lock out one host under a per-host limit or drain the shared pool under a global limit, blocking later requests even when no connection remains open. The default unlimited connection setting is not affected. This issue is fixed in version 3.0.12.", "A flaw was found in AsyncHttpClient. When configured with connection limits, the library can leak a connection permit if a Transport Layer Security (TLS) handshake fails before completion. This permit leak can lead to resource exhaustion, allowing a remote attacker to cause a denial of service by repeatedly failing TLS connection establishments, thereby preventing legitimate requests from being processed."], "mitigation": {"lang": "en:us", "value": "Red Hat products are not affected by this vulnerability. No mitigation is required for Red Hat customers. For third-party Java applications using async-http-client versions 3.0.8 through 3.0.11, upgrade to version 3.0.12 or later. Alternatively, use the default unlimited connection setting, which is not affected by this vulnerability."}, "name": "CVE-2026-85718", "package_state": [{"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Out of support scope", "package_name": "async-http-client", "product_name": "Red Hat Fuse 7"}], "public_date": "2026-09-17T15:58:40Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-85718\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-85718\nhttps://github.com/AsyncHttpClient/async-http-client/commit/64eb57af52a003ae7f29a2f9f4502271bbb138dd\nhttps://github.com/AsyncHttpClient/async-http-client/issues/2189\nhttps://github.com/AsyncHttpClient/async-http-client/pull/2288\nhttps://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-gcmv-gr82-6m8v"], "statement": "A denial of service vulnerability was found in async-http-client, an asynchronous HTTP client library for Java. From versions 3.0.8 until 3.0.12, a client with maxConnections or maxConnectionsPerHost set above zero leaks one connection permit whenever TLS connection establishment fails before the handshake completes. Repeated TLS handshake failures can permanently exhaust the connection permit pool under a per-host limit or drain the shared pool under a global limit, blocking all future HTTP requests even when no connections remain open. This requires an application restart to recover. Red Hat products do not ship vulnerable versions of async-http-client. The issue is fixed in async-http-client 3.0.12.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.0.8,3.0.12)"}}], "enrichment": {"confidence": 89.0, "confidence_source": "matching", "scores": [{"score": 89.0, "source": "matching"}]}, "original": {"product": "async-http-client", "source": "cna", "vendor": "AsyncHttpClient"}, "product": "async-http-client", "vendor": "asynchttpclient_project"}], "created": "2026-09-18T20:30:15.713647+00:00", "updated": "2026-09-20T04:15:17.359587+00:00", "vendors": ["asynchttpclient_project", "asynchttpclient_project$PRODUCT$async-http-client"]}