AsyncHttpClient CVE-2026-85721

Exploitation requires the AsyncHttpClient-based application to send an HTTP request to a server the attacker controls, has compromised, or can rewrite responses for in transit (an active/MITM position) - this is a client-side library, so there is no directly listening service to attack. The vulnerable path is automatic response decompression: the server returns a compressed body via Content-Encoding of gzip, deflate, or snappy (all affected by default), or brotli/zstd (affected only when those optional codecs are on the classpath). Affects AHC 2.0.0 up to but not including 2.16.1, and 3.x before 3.0.12; on releases 3.0.8 through 3.0.10 the HTTP/2 decompressor is also unbounded, so switching to HTTP/2 does not mitigate. No authentication or user interaction is needed on the client side, but realistic risk is limited to deployments that make outbound calls to untrusted, attacker-influenceable, or user-specified URLs.

This is a genuine but bounded availability risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) correctly captures a network-reachable, low-complexity, unauthenticated flaw with pure availability impact (no confidentiality or integrity loss) - the client is crashed via OutOfMemoryError, nothing is read or altered. The 7.5 score is defensible and I concur. However, the CVSS network vector understates the real precondition: this is a CLIENT-side library flaw, so the 'attacker' must be the server the client chooses to talk to (hostile or compromised) or an in-path adversary who can rewrite responses - the victim application must initiate the connection. That is not the same threat surface as a remotely reachable server bug, so the practical exploitability is lower than a naive reading of AV:N/PR:N suggests. No EPSS score, no CISA KEV listing, and no public exploit code are provided in the intelligence, so exploitation status is 'no public exploit identified at time of analysis.' The mechanism (a decompression bomb - small compressed body inflating without a cumulative limit) is well understood and the fix commits are public, which modestly lowers the effort to build a POC, but there is no evidence of active exploitation. Net: a real, patch-worthy DoS for services that make outbound HTTP calls through AHC to untrusted or attacker-influenceable endpoints, but not a drop-everything emergency absent KEV/EPSS signals.

A Java service uses AsyncHttpClient to fetch data from an external HTTP endpoint (e.g., a webhook target, third-party API, or URL supplied via SSRF-style user input). An attacker who controls or has compromised that endpoint - or who sits in the network path - returns a tiny gzip/deflate/snappy (or brotli/zstd where those codecs are present) response that AHC auto-decompresses across many small chunks with no cumulative size cap, inflating until the client JVM exhausts its heap and throws OutOfMemoryError, taking down the calling service. No public exploit code is identified, but the fix commits publicly reveal the mechanism.