CVE-2026-107283

Name of the Vulnerable Software and Affected Versions AsyncHttpClient versions prior to 3.0.12 AsyncHttpClient versions prior to 2.16.1

Description The Realm.Builder generates the HTTP Digest client nonce using ThreadLocalRandom instead of a cryptographically secure random source. Because HTTP Digest authentication relies on an unpredictable client nonce (cnonce) to prevent chosen-plaintext and credential precomputation attacks, an observer who can infer the generator state may weaken the protection of the authentication exchange.

Recommendations Update to version 3.0.12 or later. Update to version 2.16.1 or later.