CVE-2026-102740

Name of the Vulnerable Software and Affected Versions AsyncHttpClient versions 2.0.0 through 2.16.0 AsyncHttpClient versions 3.0.0 through 3.0.11

Description The PropertiesBasedResumableProcessor stores resumable download state at a predictable shared path $java.io.tmpdir/ahc/ResumableAsyncHandler.properties using default permissions and link-following file operations. This occurs when ResumableAsyncHandler decorates another AsyncHandler. A local user with read access to this shared store can view download URLs, which may contain embedded user information or query tokens. Additionally, a local user with write access to the shared store directory can create a symbolic link that the client follows during state saving, allowing the user to truncate and overwrite target files writable by the client process.

Recommendations Update to version 2.16.1. Update to version 3.0.12.