{"items":[{"id":"NVI-00013999","kind":"vulnerability","title":"AsyncHttpClient doesn't verify SCRAM and Digest mutual-authentication responses","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-fj9w-c36g-h5x8","CVE-2026-85716"],"plain_summary":"GitHub lists this reviewed advisory for org.asynchttpclient:async-http-client. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-0ac18a48024be5eccc5e791c04bc0782"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-09-17T17:18:40.000Z","value":"3.7 low","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-2fa2f83706ecb564bcf4f8e87754fba1"},{"kind":"EPSS","as_of":"2026-11-05T12:03:04.000Z","value":"0.409%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.35315. Missing scores are unknown.","source_id":"sr-0ac18a48024be5eccc5e791c04bc0782"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-2fa2f83706ecb564bcf4f8e87754fba1","url":"https://github.com/advisories/GHSA-fj9w-c36g-h5x8","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-fj9w-c36g-h5x8","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T14:29:49.409Z"},{"id":"sr-0ac18a48024be5eccc5e791c04bc0782","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-85716","publisher":"FIRST EPSS","observed_at":"2026-11-06T07:17:46.400Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-2fa2f83706ecb564bcf4f8e87754fba1"],"technology":"org.asynchttpclient:async-http-client","known_exclusions":[],"conditions_summary":"### Impact\nFor SCRAM, and for Digest with mutual authentication, the client computes the server's verification value (the SCRAM ServerSignature, or the Digest rspauth) but does not act on the result. If the value is present and does not verify, the client only logs it and still delivers the response to the application as a successful, authenticated result. A server that never proved knowledge of the shared secret is accepted, so the client loses its ability to detect an impostor. Over TLS the real server always returns a valid value and the issue is inert; it matters over a non TLS transport, or when the transport is already compromised, where it removes the client's only signal that the peer does not know the secret.\n\n### Affected versions\n* 3.x: 3.0.8 through 3.0.11\n\nEarlier 3.0.x releases are not affected: neither SCRAM nor the Digest Authentication-Info handling existed before 3.0.8. The 2.x line is not affected either: it has no SCRAM support, and its interceptor chain does not implement Digest mutual authentication, so there is no verification result to act on.\n\n### Patches\nFixed in 3.0.12. A present ServerSignature (SCRAM) or rspauth (Digest) that does not verify now fails t","public_affected_ranges":[">= 3.0.8, <= 3.0.11"]}],"null_published_at":"2026-11-08T15:11:49.420Z","source_updated_at":"2026-09-17T17:18:40.000Z","source_disclosed_at":"2026-09-17T17:18:39.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-11-01T14:29:49.409Z"},{"id":"NVI-00013999","kind":"vulnerability","title":"AsyncHttpClient doesn't verify SCRAM and Digest mutual-authentication responses","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-fj9w-c36g-h5x8","CVE-2026-85716"],"plain_summary":"GitHub lists this reviewed advisory for org.asynchttpclient:async-http-client. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-2fa2f83706ecb564bcf4f8e87754fba1"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-09-17T17:18:40.000Z","value":"3.7 low","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-2fa2f83706ecb564bcf4f8e87754fba1"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-2fa2f83706ecb564bcf4f8e87754fba1","url":"https://github.com/advisories/GHSA-fj9w-c36g-h5x8","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-fj9w-c36g-h5x8","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T14:29:49.409Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-2fa2f83706ecb564bcf4f8e87754fba1"],"technology":"org.asynchttpclient:async-http-client","known_exclusions":[],"conditions_summary":"### Impact\nFor SCRAM, and for Digest with mutual authentication, the client computes the server's verification value (the SCRAM ServerSignature, or the Digest rspauth) but does not act on the result. If the value is present and does not verify, the client only logs it and still delivers the response to the application as a successful, authenticated result. A server that never proved knowledge of the shared secret is accepted, so the client loses its ability to detect an impostor. Over TLS the real server always returns a valid value and the issue is inert; it matters over a non TLS transport, or when the transport is already compromised, where it removes the client's only signal that the peer does not know the secret.\n\n### Affected versions\n* 3.x: 3.0.8 through 3.0.11\n\nEarlier 3.0.x releases are not affected: neither SCRAM nor the Digest Authentication-Info handling existed before 3.0.8. The 2.x line is not affected either: it has no SCRAM support, and its interceptor chain does not implement Digest mutual authentication, so there is no verification result to act on.\n\n### Patches\nFixed in 3.0.12. A present ServerSignature (SCRAM) or rspauth (Digest) that does not verify now fails t","public_affected_ranges":[">= 3.0.8, <= 3.0.11"]}],"null_published_at":"2026-11-02T10:00:37.195Z","source_updated_at":"2026-09-17T17:18:40.000Z","source_disclosed_at":"2026-09-17T17:18:39.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-01T14:29:49.409Z"}],"next_cursor":null,"snapshot_revision":"42594"}