[Git][security-tracker-team/security-tracker][master] new async-http-client issues

[Moritz Muehlenhoff (@jmm)]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
e3ffb938 by Moritz Muehlenhoff at 2026-10-08T10:40:46+02:00
new async-http-client issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -249,31 +249,56 @@ CVE-2026-107315 (pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 through 42.
 CVE-2026-107314 (pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.11 through 42.7.13 e ...)
 	TODO: check
 CVE-2026-107285 (The AsyncHttpClient (AHC) library allows Java applications to easily e ...)
-	TODO: check
+	- async-http-client <unfixed>
+	NOTE: https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-3wp9-xfwm-rjjf
+	NOTE: https://github.com/AsyncHttpClient/async-http-client/commit/c4feab0f7f86d61505a48e40d383c8a375a22e18 (async-http-client-project-2.16.1)
 CVE-2026-107284 (The AsyncHttpClient (AHC) library allows Java applications to easily e ...)
-	TODO: check
+	- async-http-client <unfixed>
+	NOTE: https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-rwhr-j9rv-85f8
+	NOTE: https://github.com/AsyncHttpClient/async-http-client/commit/75a278550aa9a980009d022fb4e635f9c8738c03 (async-http-client-project-2.16.1)
 CVE-2026-107283 (The AsyncHttpClient (AHC) library allows Java applications to easily e ...)
-	TODO: check
+	- async-http-client <unfixed>
+	NOTE: https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-mfj3-87qq-382v
+	NOTE: https://github.com/AsyncHttpClient/async-http-client/commit/e1f5fc88fe211d3f64032c33b91093ba3d5e793d (async-http-client-project-2.16.1)
 CVE-2026-107282 (The AsyncHttpClient (AHC) library allows Java applications to easily e ...)
-	TODO: check
+	- async-http-client <unfixed>
+	NOTE: https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-jmqq-x5g9-9p2w
+	NOTE: https://github.com/AsyncHttpClient/async-http-client/commit/bbc31aed3b044f9f7a126cf689a8c8d7ad2ae1cb (async-http-client-project-2.16.1)
 CVE-2026-107281 (The AsyncHttpClient (AHC) library allows Java applications to easily e ...)
-	TODO: check
+	- async-http-client <unfixed>
+	NOTE: https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-vvp4-63h8-v5pm
+	NOTE: https://github.com/AsyncHttpClient/async-http-client/commit/73813babf51231ee79f7da4f07b777f19f48d34d (async-http-client-project-2.16.1)
 CVE-2026-107280 (The AsyncHttpClient (AHC) library allows Java applications to easily e ...)
-	TODO: check
+	- async-http-client <unfixed>
+	NOTE: https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-f9m8-cv68-674w
+	NOTE: https://github.com/AsyncHttpClient/async-http-client/commit/d1f0ccec417092098d40242fee7dfac84bb3c21f (async-http-client-project-2.16.1)
 CVE-2026-107279 (The AsyncHttpClient (AHC) library allows Java applications to easily e ...)
-	TODO: check
+	- async-http-client <not-affected> (Only affects 3.x)
+	NOTE: https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-qhv6-3pmh-95q4
 CVE-2026-107232 (The AsyncHttpClient (AHC) library allows Java applications to easily e ...)
-	TODO: check
+	- async-http-client <unfixed>
+	NOTE: https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-v9f2-7rw2-gr2x
+	NOTE: https://github.com/AsyncHttpClient/async-http-client/commit/3a625cb892233c0a6653ac68823a25ffbc80f393 (async-http-client-project-2.16.1)
 CVE-2026-107231 (The AsyncHttpClient (AHC) library allows Java applications to easily e ...)
-	TODO: check
+	- async-http-client <unfixed>
+	NOTE: https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-rqf5-2wxv-rjf4
+	NOTE: https://github.com/AsyncHttpClient/async-http-client/commit/c8d639bf6ac341d377d610a93570bcd15565f1a6 (async-http-client-project-2.16.1)
 CVE-2026-107230 (The AsyncHttpClient (AHC) library allows Java applications to easily e ...)
-	TODO: check
+	- async-http-client <unfixed>
+	NOTE: https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-v2j5-22fr-j62r
+	NOTE: https://github.com/AsyncHttpClient/async-http-client/commit/d3bb4d68b41acf5d3ab7541afa9fdfe7ec3ba054 (async-http-client-project-3.0.14)
 CVE-2026-107229 (The AsyncHttpClient (AHC) library allows Java applications to easily e ...)
-	TODO: check
+	- async-http-client <unfixed>
+	NOTE: https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-qjr7-w8pj-pmv9
+	NOTE: https://github.com/AsyncHttpClient/async-http-client/commit/7dc5bbc2d0a48aa2a9caf089a626dcfd333168e9 (async-http-client-project-3.0.14)
 CVE-2026-107228 (The AsyncHttpClient (AHC) library allows Java applications to easily e ...)
-	TODO: check
+	- async-http-client <unfixed>
+	NOTE: https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-2jwh-9rmr-j4xf
+	NOTE: https://github.com/AsyncHttpClient/async-http-client/commit/fd9763620725126c1c8bb0af1ceb9a7523099a5f (async-http-client-project-3.0.14)
 CVE-2026-107227 (The AsyncHttpClient (AHC) library allows Java applications to easily e ...)
-	TODO: check
+	- async-http-client <unfixed>
+	NOTE: https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-x8v2-478q-2hvg
+	NOTE: https://github.com/AsyncHttpClient/async-http-client/commit/b61637f30327f314b7693418f12ce141ac6b2b30 (async-http-client-project-3.0.14)
 CVE-2026-107176 (A flaw was found in the cluster-samples-operator. The RBAC Role coreos ...)
 	NOT-FOR-US: cluster-samples-operator
 CVE-2026-107161 (A heap-based buffer overflow flaw was found in Cyrus SASL. The add_to_ ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e3ffb938652f63c797e77c3343410957a43b5d22

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e3ffb938652f63c797e77c3343410957a43b5d22
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261008/921c3f50/attachment-0001.htm>