Source: async-http-client Version: 2.12.3-1 X-Debbugs-CC: [email protected] Severity: grave Tags: security upstream Forwarded: https://github.com/AsyncHttpClient/async-http-client/pull/2281
Hi, The following vulnerability was published for async-http-client. CVE-2026-102740[0]: | The AsyncHttpClient library allows Java applications to execute HTTP | requests and asynchronously process HTTP responses. From 2.0.0 until | 2.16.1 and 3.0.12, PropertiesBasedResumableProcessor stores | resumable download state at the predictable shared path | $java.io.tmpdir/ahc/ResumableAsyncHandler.properties with default | permissions and link-following file operations. A local user who can | read the shared store can see download URLs, including embedded user | information or query tokens. A local user who can write within or | pre-create the affected shared store directory can plant a symbolic | link that the client follows when saving state, truncating and | overwriting a target file writable by the client process. The | filesystem path is used when ResumableAsyncHandler decorates another | AsyncHandler, while the no-argument constructors use a no-op | processor and are unaffected. This issue is fixed in versions 2.16.1 | and 3.0.12. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-102740 https://www.cve.org/CVERecord?id=CVE-2026-102740 [1] https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-cf59-3jcr-vfhw [2] https://github.com/AsyncHttpClient/async-http-client/pull/2281 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
