CVE-2026-85721 - Vulnerability details

7.5/10

CVSS 3.1

CVE-2026-85721

resolved Published 2026-09-17 Updated 2026-09-30

NVD

MITRE

OpenCVE

Show outdated versions

Vulnerability Data from Dependency-Track

Affected versions

5.7

5.7.2 5.7.1 5.7.0

5.6

5.6.8 5.6.7 5.6.6 5.6.5 5.6.4 5.6.3 5.6.2 5.6.1 5.6.0

5.5

5.5.19 5.5.18 5.5.17 5.5.16 5.5.15 5.5.14 5.5.13 5.5.12 5.5.11 5.5.10 5.5.9 5.5.8 5.5.7 5.5.6 5.5.5 5.5.4 5.5.3 5.5.2 5.5.1 5.5.0

5.4

5.4.13 5.4.12 5.4.11 5.4.10 5.4.9 5.4.8 5.4.7 5.4.6 5.4.5 5.4.4 5.4.3 5.4.2 5.4.1 5.4.0

Fixed in version 5.7.3 No fix yet in 5.6, 5.5, 5.4

Score

7.5 CVSS 3.1 NVD CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Description

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 and 3.0.12, automatic response decompression on the HTTP/1.1 path uses ChannelManager.newHttpContentDecompressor() to install Http1ContentDecompressor without a cumulative output-size limit. A hostile or compromised server, or an attacker who can alter a response in transit, can send a small gzip, deflate, or snappy response that expands across chunks until the client exhausts its heap and raises OutOfMemoryError; brotli and zstd are also affected when their optional codecs are present. In versions 3.0.8 through 3.0.10, the HTTP/2 decompressor is also unbounded, so switching protocols does not mitigate the issue on those releases. A limit applied to each decode call is insufficient because the response can be delivered as many small chunks, so the fixed implementation tracks total decompressed bytes for the whole response. This issue is fixed in versions 2.16.1 and 3.0.12.

Same vulnerability as

GHSA-7grg-jcf7-rpmx resolved according to EUVD-2026-81907

Analysis Read only

State

Justification

Recommandation

Workaround

The analysis can only be edited by the BlueMind security teams: log in.

CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation. CVE data may be incomplete, delayed, or inaccurate. This website and all information provided are offered on an “as is” basis without warranties of any kind. This site is not affiliated with, endorsed by, or sponsored by the CVE Program or The MITRE Corporation.

This site uses data from the National Vulnerability Database (NVD), obtained through Dependency-Track, but is not endorsed or certified by the NVD or the National Institute of Standards and Technology (NIST). NVD data may be incomplete, delayed, or inaccurate.

CVSS (Common Vulnerability Scoring System) is owned and managed by FIRST.Org, Inc. and used by permission. The links on CVSS vectors open the FIRST CVSS calculators (CVSS 3.0, 3.1 and 4.0), or the NVD calculator for CVSS 2.0. This site is not affiliated with, endorsed by, or sponsored by FIRST.

GitHub is a trademark of GitHub, Inc. GHSA identifiers and advisory data come from the GitHub Advisory Database, licensed under CC-BY 4.0. GHSA data may be incomplete, delayed, or inaccurate. This site is not affiliated with, endorsed by, or sponsored by GitHub, Inc.

Source of the EUVD data: European Vulnerability Database (EUVD), © European Union Agency for Cybersecurity (ENISA), reused with acknowledgement of the source as provided by the ENISA legal notice and IPR policy. Changes: CVEManager does not display the EUVD records as such; it uses their aliases to link the CVE and GHSA identifiers designating the same vulnerability. EUVD data may be incomplete, delayed, or inaccurate. This site is not affiliated with, endorsed by, or sponsored by ENISA or the European Union.