How severe is CVE-2026-85717?

CVE-2026-85717 has a CVSS score of 6.8/10, rated MEDIUM. Review your exposure and patch according to your risk tolerance.

Which packages are affected by CVE-2026-85717?

CVE-2026-85717 affects the following packages: org.asynchttpclient:async-http-client (Maven), org.asynchttpclient:async-http-client (Maven). Ecosystems affected: Maven.

How do I fix CVE-2026-85717?

Update org.asynchttpclient:async-http-client to 3.0.12 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-85717 is resolved across your whole dependency graph.

How do I detect CVE-2026-85717 in my Maven dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for org.asynchttpclient:async-http-client, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

How do I mitigate CVE-2026-85717 if there is no patch (or I can't update yet)?

Assume what was exposed is already known: rotate any credential, token or key that the affected component could return, restrict the endpoint to callers that genuinely need it, and strip sensitive fields from responses and error output at the boundary rather than relying on the client not to read them.

Is CVE-2026-85717 actively exploited in the wild?

No public exploit code has been indexed for CVE-2026-85717 yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

What is the EPSS score for CVE-2026-85717?

CVE-2026-85717 has an EPSS (Exploit Prediction Scoring System) score of 0.5%, placing it in the 45th percentile of all CVEs. EPSS is maintained by FIRST.org and estimates the probability that a vulnerability will be exploited in the wild within the next 30 days. This score indicates relatively lower exploitation probability, though the CVSS severity should still guide your patching priority.

What type of vulnerability is CVE-2026-85717?

CVE-2026-85717 is classified as Information Exposure (CWE-200), CWE-522 (CWE-522). These weakness types describe the underlying flaw category, which helps determine the potential impact and the right class of mitigation.

When was CVE-2026-85717 published, and has it been updated?

CVE-2026-85717 was published on September 17, 2026 and was last updated on October 28, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

☕

☕ Maven

Not in CISA KEV

MEDIUM severity

CVE-2026-85717 — async-http-client

MEDIUMFix: AsyncHttpClient/async-http-client@43db7bb

CVE-2026-85717 is a medium-severity (CVSS 6.8) Information Exposure vulnerability in org.asynchttpclient:async-http-client. A fix is available for org.asynchttpclient:async-http-client — see the affected versions and patch details below.

AsyncHttpClient: Client-wide realm credentials re-sent to a cross-origin redirect target

Also known asGHSA-f8m2-889x-vw4x

Published

Sep 17, 2026

Updated

Oct 28, 2026

Affected

2 pkgs

Patched

2 / 2

Exploits

None indexed

Exploitation data as of Oct 29, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

No confirmed exploitation observed yet

CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for CVE-2026-85717.

EPSS Exploitation Probability

via FIRST.org ↗

0.5%probability of exploitation in next 30 days

Lower Risk0.00%

Lower risk than most CVEs45th percentile — riskier than 45% of all scored CVEsHighest risk

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

Where this sits among everything scored

Real-World Exposure

2 pkgs affected

☕org.asynchttpclient:async-http-client☕org.asynchttpclient:async-http-client

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.

Description

Impact

A client configured with a client-wide realm (a Realm set on the config builder rather than on an individual request) and following redirects could re-send those credentials to a redirect target on a different origin. The redirect code strips the per-exchange realm, but when the target answered 401 the credentials were re-derived from the client config, handing Basic or Digest credentials, or a Negotiate or NTLM token, to an attacker controlled origin. This is a residual of the earlier cross-origin credential leak advisories, whose strip this bypassed.

Affected versions

3.x: 3.0.9 through 3.0.11
2.x: 2.14.5 through 2.16.0

Releases below those floors are covered by the earlier advisories GHSA-cmxv-58fp-fm3g and GHSA-fmxf-pm6p-7xgm: the cross-origin strip that this issue bypasses did not exist yet, so the leak there is the original one rather than this residual.

Patches

Fixed in 3.0.12 on the 3.x line and in 2.16.1 on the 2.x line. The realm is taken from the per-exchange state that the redirect already cleared, rather than being re-derived from the client configuration.

Workarounds

Set the Realm on the individual request instead of on the client configuration. A per-request realm is stripped correctly on a cross-origin redirect while still authenticating same-origin, so this is a complete workaround with no loss of function. Turning off follow-redirects also avoids it. Note that setStripAuthorizationOnRedirect(true) is not a workaround: it forces the strip, but the configuration fallback re-derived the realm regardless.

Details

The interceptor read the realm as the request's realm or, failing that, the client configuration's realm, which re-attached the config realm after the redirect strip had cleared it. It now reads the realm held on the response future. See also GHSA-cmxv-58fp-fm3g and GHSA-fmxf-pm6p-7xgm.

Affected Packages

2 total 2 fixed

Ecosystem	Package	Vulnerable range	Fix
☕Maven	`org.asynchttpclient:async-http-client`	≥ 3.0.9&&< 3.0.12	3.0.12`org.asynchttpclient:async-http-client:3.0.12`
☕Maven	`org.asynchttpclient:async-http-client`	≥ 2.14.5&&< 2.16.1	2.16.1`org.asynchttpclient:async-http-client:2.16.1`

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for org.asynchttpclient:async-http-client, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update org.asynchttpclient:async-http-client to 3.0.12 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-85717 is resolved across your whole dependency graph.
Workarounds
Assume what was exposed is already known: rotate any credential, token or key that the affected component could return, restrict the endpoint to callers that genuinely need it, and strip sensitive fields from responses and error output at the boundary rather than relying on the client not to read them.

Frequently Asked Questions

### Impact A client configured with a client-wide realm (a Realm set on the config builder rather than on an individual request) and following redirects could re-send those credentials to a redirect target on a different origin. The redirect code strips the per-exchange realm, but when the target answered 401 the credentials were re-derived from the client config, handing Basic or Digest credentials, or a Negotiate or NTLM token, to an attacker controlled origin. This is a residual of the earlier cross-origin credential leak advisories, whose strip this bypassed. ### Affected versions * 3.x: