AsyncHttpClient EUVD-2026-94643

Exploitation requires that the Java application use AsyncHttpClient's HTTP Digest authentication via Realm.Builder (affected versions prior to 3.0.12 and 2.16.1), where the client nonce (cnonce) is generated with ThreadLocalRandom. The attacker must be able to observe the Digest authentication exchanges and infer the non-cryptographic generator's state to predict cnonce values. Limiting factors: applications not using Digest auth are unaffected; the attack is statistical and high-complexity (AC:H) rather than a direct exploit, requires passive observation of multiple exchanges, and only reduces the strength of the authentication exchange (partial confidentiality) rather than granting direct access.

This is a genuinely low-priority issue despite being a real cryptographic weakness. The CVSS base score of 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) is consistent with the description: exploitation requires high attack complexity (AC:H) because an attacker must observe Digest exchanges and infer the state of a non-cryptographic PRNG (ThreadLocalRandom), and the impact is limited to partial confidentiality (C:L) with no integrity or availability impact. CWE-338 (use of a cryptographically weak PRNG) matches the root cause confirmed in the fix commit, which swaps ThreadLocalRandom for SecureRandom. No EPSS score was provided in the input, so exploitation probability cannot be quantified. There is no CISA KEV listing and no public exploit code identified - the GitHub links are the vendor advisory, fix commits, and release tags, not a POC. The AV:N vector reflects that the HTTP exchange is network-observable, but practical exploitation is heavily constrained: it only matters for applications actually using HTTP Digest authentication (itself uncommon), and the attack is theoretical/statistical rather than a direct code path. Net assessment: a legitimate defense-in-depth fix, but low real-world risk and not an urgent patching priority relative to higher-severity issues.

An attacker positioned to observe an application's outbound HTTP Digest authentication exchanges collects multiple client nonce (cnonce) values and uses knowledge of ThreadLocalRandom's predictable internal state to narrow or predict future cnonce values. With predictable cnonces, the attacker can mount chosen-plaintext or credential-precomputation attacks against the Digest exchange, weakening the authentication's resistance. No public exploit code was identified at time of analysis, and the attack requires high complexity to infer the generator state.