Async Http Client
Vendor:
First CVE: Jun 24, 2015 · Active for 11 years
5
Total CVEs
More Total CVEs than 64% of tracked products
1.3
Avg CVEs / Year
Bottom 1%
6.2
Avg CVSS
Higher Avg CVSS than 50% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Async Http Client over time
Volume of CVEsAvg CVSS Base Score
First CVE
Jun 24, 2015
11 years ago
Most Recent CVE
Jun 5, 2026
49 days ago
CVE Severity & Scoring
Async Http Client5 CVEs
40%
60%
All CVEs352,231 CVEs
45%
40%
11%
MediumHigh
Attack Vector
Local0 (0.0%)
Network3 (60.0%)
Unknown2 (40.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low3 (60.0%)
High0 (0.0%)
Unknown2 (40.0%)
User Interaction
None2 (40.0%)
Unknown2 (40.0%)
Required1 (20.0%)
Privileges Required
Low0 (0.0%)
High0 (0.0%)
None3 (60.0%)
Unknown2 (40.0%)
Top CVEs
Signals from CVEs in this product scope (5 CVEs).
5 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-45300HIGH The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Versions on the 2.x branch prior to 2.15.0 and | Jun 5, 2026 | 7.4 | 32 | NO | NO |
CVE-2017-14063HIGH Async Http Client (aka async-http-client) before 2.0.35 can be tricked into connecting to a host different from the one extracted by java.net.URI if a '?' character occurs in a fra | Aug 31, 2017 | 7.5 | 25 | NO | NO |
CVE-2023-0040HIGH Versions of Async HTTP Client prior to 1.13.2 are vulnerable to a form of targeted request manipulation called CRLF injection. This vulnerability was the result of insufficient val | Jan 18, 2023 | 7.5 | 24 | NO | NO |
CVE-2013-7398MEDIUM main/java/com/ning/http/client/AsyncHttpClientConfig.java in Async Http Client (aka AHC or async-http-client) before 1.9.0 does not require a hostname match during verification of | Jun 24, 2015 | 4.3 | 18 | NO | NO |
CVE-2013-7397MEDIUM Async Http Client (aka AHC or async-http-client) before 1.9.0 skips X.509 certificate verification unless both a keyStore location and a trustStore location are explicitly set, whi | Jun 24, 2015 | 4.3 | 17 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (5 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (5 CVEs).
Media Mentions
Signals from CVEs in this product scope (5 CVEs).
Top CNAs Publishing CVEs For Async Http Client
Top CWEs
Versions
No cataloged versions.