AsyncHttpClient CVE-2026-85719

Exploitation requires the victim application to be configured with an AUTHENTICATED SOCKS proxy (SOCKS4 or SOCKS5, with a proxy Realm holding Basic/NTLM/Kerberos/SPNEGO credentials) in AsyncHttpClient versions 2.1.0 through 2.16.0 or 3.0.x before 3.0.12 (pre-2.1.0 has no SOCKS support and is unaffected). Two triggering paths: (1) with preemptive proxy authentication enabled, the Proxy-Authorization header is attached to plaintext HTTP requests and leaks directly-reversible Basic credentials to ANY origin, including benign ones; (2) in the default non-preemptive flow, a HOSTILE/attacker-controlled origin must return an HTTP 407 response, causing ProxyUnauthorized407Interceptor to send proxy credentials (including NTLM/Kerberos/SPNEGO) through the SOCKS tunnel to that origin. Limiting factors: no exploitation is possible without an authenticated SOCKS proxy configuration, and the non-preemptive path additionally requires the attacker to control or influence the destination origin the victim connects to.

This is a credential-exposure flaw (CWE-319) in AsyncHttpClient, rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) by the reporter, which I agree with in magnitude - confidentiality-only, high impact, no integrity or availability effect. The vector's PR:N is technically correct because the attacking party (a hostile or simply plaintext origin server) needs no authentication, but real-world exploitability is gated by a significant precondition NOT reflected in the base vector: the victim application must be configured to route requests through an AUTHENTICATED SOCKS proxy. No EPSS score, KEV listing, or public POC is provided, so exploitation status is: no public exploit identified at time of analysis. The fix commits, a dedicated regression test (SocksProxyCredentialLeakTest), and a GitHub Security Advisory (GHSA-x5w6-vm3f-pp6f) are all confirmed, so the vulnerability itself is well-substantiated even though weaponization is not. Net: a legitimately serious credential-leak bug for the subset of deployments using authenticated SOCKS proxies, but not a mass-exploitation priority - treat as a targeted/passive-leak risk rather than an internet-wide emergency. The provided 'Authentication Bypass' tag is a mislabel; the actual class is cleartext credential exposure to the origin.

A Java service uses AsyncHttpClient with an authenticated SOCKS5 proxy (carrying Basic, NTLM, Kerberos, or SPNEGO proxy credentials) and makes outbound HTTP requests to third-party origins. Because the library attaches Proxy-Authorization without checking the proxy is HTTP, the header (or the 407-challenge response to it) is tunneled straight to the origin - either leaking directly-reversible Basic credentials on a preemptive plaintext request, or, in the default flow, a hostile origin returns HTTP 407 and ProxyUnauthorized407Interceptor replays the proxy credentials to the attacker. No public POC is provided, but the fix's regression test demonstrates the leak conditions precisely.