Bug#1151205: async-http-client: CVE-2026-102740

[Salvatore Bonaccorso]

Source: async-http-client
Version: 2.12.3-1
X-Debbugs-CC: team at security.debian.org
Severity: grave
Tags: security upstream
Forwarded: https://github.com/AsyncHttpClient/async-http-client/pull/2281

Hi,

The following vulnerability was published for async-http-client.

CVE-2026-102740[0]:
| The AsyncHttpClient library allows Java applications to execute HTTP
| requests and asynchronously process HTTP responses. From 2.0.0 until
| 2.16.1 and 3.0.12, PropertiesBasedResumableProcessor stores
| resumable download state at the predictable shared path
| $java.io.tmpdir/ahc/ResumableAsyncHandler.properties with default
| permissions and link-following file operations. A local user who can
| read the shared store can see download URLs, including embedded user
| information or query tokens. A local user who can write within or
| pre-create the affected shared store directory can plant a symbolic
| link that the client follows when saving state, truncating and
| overwriting a target file writable by the client process. The
| filesystem path is used when ResumableAsyncHandler decorates another
| AsyncHandler, while the no-argument constructors use a no-op
| processor and are unaffected. This issue is fixed in versions 2.16.1
| and 3.0.12.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-102740
    https://www.cve.org/CVERecord?id=CVE-2026-102740
[1] https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-cf59-3jcr-vfhw
[2] https://github.com/AsyncHttpClient/async-http-client/pull/2281

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore