AsyncHttpClient CVE-2026-102740

Exploitation requires (1) the application to use ResumableAsyncHandler decorating another AsyncHandler backed by PropertiesBasedResumableProcessor - applications using the no-argument constructors get a no-op processor and are NOT vulnerable; (2) a shared, multi-user filesystem where the attacker is a separate local user who can read the default-permission store (for URL/token disclosure) or write within / pre-create the $java.io.tmpdir/ahc directory (for the symlink overwrite); and (3) the client process actually saving resumable download state so the planted link is followed. Limiting factors: no remote vector (local access mandatory), a low-but-present privilege requirement (a local account), high attack complexity from the needed directory control and timing against the save, dependence on a POSIX shared tmpdir shared across trust boundaries, and affected versions being below 2.16.1 / 3.0.12. Single-user, single-tenant, or container-isolated deployments with no untrusted local users are effectively unexposed.

This is a moderate, locally-scoped issue rather than a top-tier priority. The supplied CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L, base 5.8) is internally consistent with the description: exploitation requires a local account on a shared multi-user host (AV:L/PR:L), a non-trivial precondition and timing/race against the client's save operation (AC:H), and yields limited confidentiality (C:L - leaked download URLs/tokens) but high integrity impact (I:H - symlink-driven truncate/overwrite of a file writable by the client process). No EPSS score, KEV listing, or public POC was provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The combination of local-only vector, high attack complexity, and the requirement that the application actually use the filesystem-backed resumable handler makes this a low-to-moderate real-world risk despite the HIGH integrity sub-score. A dependency significantly narrows exposure: the flaw only applies when ResumableAsyncHandler decorates another AsyncHandler using PropertiesBasedResumableProcessor - the no-argument constructors use a no-op processor and are unaffected - so many deployments pulling in the library are not vulnerable at all. Prioritize patching on shared/multi-tenant hosts; single-tenant or containerized single-user deployments face little practical exposure.

On a shared multi-user Linux host, a low-privileged local attacker who can write to or pre-create $java.io.tmpdir/ahc plants a symbolic link at ResumableAsyncHandler.properties pointing at a file the victim Java process can write. When the application's ResumableAsyncHandler next saves resumable download state, the client follows the link and truncates/overwrites the target file; the attacker can also simply read the world-readable store to harvest download URLs containing embedded credentials or query tokens. No public exploit code was provided, and the high attack complexity reflects the need for local access and favorable timing against the client's save operation.