AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random source
Impact
The client nonce used in HTTP Digest authentication was generated from ThreadLocalRandom, a fast but non-cryptographic pseudorandom number generator. RFC 7616 section 3.3 requires the cnonce to be unpredictable, since it is part of what protects the Digest exchange against chosen-plaintext and precomputation attacks on the credentials. An attacker able to observe or influence enough of the generator's output could reduce the unpredictability the protocol depends on. NTLM (and, on the 3.x line, SCRAM) in this client already use SecureRandom for their own nonces; Digest did not.
Affected versions
- 3.x: up to and including 3.0.11
- 2.x: up to and including 2.16.0
Patches
Fixed in 3.0.12 on the 3.x line and in 2.16.1 on the 2.x line. The cnonce is now generated with SecureRandom, matching the other authentication schemes in the client.
Workarounds
None available from application code.
Details
Realm.Builder's cnonce generation seeded its bytes from ThreadLocalRandom.current() rather than a SecureRandom instance.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Java / Kotlin (Maven) | org.asynchttpclient:async-http-client | >= 3.0.0, < 3.0.12, >= 2.0.0, < 2.16.1 | 3.0.12, 2.16.1 |
References
- https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-mfj3-87qq-382v
- https://nvd.nist.gov/vuln/detail/CVE-2026-107283
- https://github.com/AsyncHttpClient/async-http-client/commit/dca2d90db87f0144ea893a6858dca13c426d06b6
- https://github.com/AsyncHttpClient/async-http-client/commit/e1f5fc88fe211d3f64032c33b91093ba3d5e793d
- https://github.com/AsyncHttpClient/async-http-client
- https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-2.16.1
- https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.12
- CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N- Weakness (CWE)
CWE-338- Platform
- Java / Kotlin (Maven)
- Package
org.asynchttpclient:async-http-client- Disclosed
- 08.10.2026
- Updated
- 11.10.2026 13:20
Sources and licenses
OSV / GitHub Advisory Database - GHSA-mfj3-87qq-382v - CC BY 4.0
Vulnerability history: org.asynchttpclient:async-http-client
All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 18
- First → latest
- 10.2018 10.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 2
- High 6
- Medium 8
- Low 2
Disclosures per year
- 2018: 1
- 2019: 0
- 2020: 0
- 2021: 0
- 2022: 0
- 2023: 0
- 2024: 1
- 2025: 0
- 2026: 16
-
AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random source this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.