Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
asynchttpclient/async-http-client
main @ ccdcaa6
8
Fixes
5
CVEs
HIGH
Peak severity
50.0%
Coverage
Highlights
Auth Bypass: 3 prior fixes. Scrutinize any change in this area.
client/src/main/java/org/asynchttpclient/netty/handler/intercept/Redirect30xInterceptor.java: most-fixed (3 issues). Treat as high-risk during review.
2 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Information Disclosure: The client repeatedly leaked highly sensitive headers including Authorization, Proxy-Authorization, Cookies, and Realm credentials across domain boundaries and HTTPS-to-HTTP downgrades. This represents a severe, recurring data disclosure risk during automated redirect handling.
Auth Bypass: A control-flow flaw in the WebSocket handshake allowed the client to proceed with unverified peers and fire the `onOpen` event even when server Sec-WebSocket-Accept key validation failed.
Auth Bypass: Misconfigured, unreachable, or failing SOCKS proxies caused the pipeline builder to silently drop the proxy configuration and fallback to direct, unproxied connections, bypassing intended network isolation.