Skip to content

Product

com.ning/async-http-client vulnerabilities

2 published CVES affecting com.ning/async-http-client, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
2
Critical
0
High
0
Medium
2
Low
0
Unscored
0
CISA KEV
0

Latest com.ning/async-http-client CVEs

Newest publication first

  1. CVE-2013-7397 Insufficient Verification of Data Authenticity in Async Http Client

    Published
    MediumCVSS 4.3 EPSS 0.99%

    Async Http Client (aka AHC or async-http-client) before 1.9.0 skips X.509 certificate verification unless both a keyStore location and a trustStore location are explicitly set, which allows man-in-the-middle attackers to spoof HTTPS servers by presenting an arbitrary certificate...

  2. CVE-2013-7398 Insufficient Verification of Data Authenticity in Async Http Client

    Published
    MediumCVSS 4.3 EPSS 0.83%

    main/java/com/ning/http/client/AsyncHttpClientConfig.java in Async Http Client (aka AHC or async-http-client) before 1.9.0 does not require a hostname match during verification of X.509 certificates, which allows man-in-the-middle attackers to spoof HTTPS servers via an arbitrary...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.