AsyncHttpClient EUVD-2026-94638

Exploitation requires that the victim Java application uses AsyncHttpClient's Digest authentication (a Realm configured with credentials) and relies on mutual authentication, AND that the peer/server presents a Digest challenge advertising qop="auth-int" as its only quality-of-protection option. The flaw does NOT trigger when the server offers 'auth' or 'auth,auth-int', because AHC prefers 'auth' and verifies its rspauth. The attacker must be able to serve or MITM the HTTP response seen by the client (a rogue server the client connects to, or on-path interception rewriting WWW-Authenticate). Key limiting factors: Digest mutual authentication is an uncommon deployment choice and an auth-int-only challenge is atypical of legitimate servers; no user interaction and no attacker credentials are needed. Affected in 3.0.12; fixed in 3.0.13.

The input CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N, score 8.8) describes a network-reachable, unauthenticated, no-interaction flaw whose primary impact is integrity (VI:H) with limited confidentiality exposure (VC:L) and no availability impact - consistent with server impersonation rather than data theft, which makes the 'Information Disclosure' tag a weak fit. No EPSS score, no CISA KEV listing, and no public exploit were provided; the only public code is the upstream fix commit, so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data was supplied. These signals conflict with the headline severity: the raw score implies easy remote compromise, but real-world risk is gated by an uncommon precondition - the victim application must use AHC Digest mutual authentication AND the peer must advertise qop=auth-int as its only option (an 'auth,auth-int' challenge is NOT affected because 'auth' is preferred and its rspauth is verified). The attacker is a rogue or MITM-positioned server, not an unprivileged user attacking a listening service. Net: a genuine but conditional authentication-bypass/integrity issue - patch promptly where AHC Digest mutual auth is in use, but absent EPSS/KEV/POC evidence it is not a mass-exploitable, drop-everything vulnerability.

A Java application using AsyncHttpClient 3.0.12 connects to an endpoint with Digest mutual authentication configured. An attacker operating that endpoint (or MITM-rewriting the challenge) returns a Digest WWW-Authenticate header offering only qop=auth-int; AHC computes no expected rspauth, treats the result as unverifiable-but-nonfatal, and accepts an invalid rspauth, so the attacker is trusted as the authenticated server without knowing the shared secret. No public exploit code is identified - only the upstream fix commit is published.