Hi,

The following vulnerability was published for async-http-client.

CVE-2026-102740[0]:
| The AsyncHttpClient library allows Java applications to execute HTTP
| requests and asynchronously process HTTP responses. From 2.0.0 until
| 2.16.1 and 3.0.12, PropertiesBasedResumableProcessor stores
| resumable download state at the predictable shared path
| $java.io.tmpdir/ahc/ResumableAsyncHandler.properties with default
| permissions and link-following file operations. A local user who can
| read the shared store can see download URLs, including embedded user
| information or query tokens. A local user who can write within or
| pre-create the affected shared store directory can plant a symbolic
| link that the client follows when saving state, truncating and
| overwriting a target file writable by the client process. The
| filesystem path is used when ResumableAsyncHandler decorates another
| AsyncHandler, while the no-argument constructors use a no-op
| processor and are unaffected. This issue is fixed in versions 2.16.1
| and 3.0.12.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-102740
https://www.cve.org/CVERecord?id=CVE-2026-102740
[1] https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-cf59-3jcr-vfhw
[2] https://github.com/AsyncHttpClient/async-http-client/pull/2281

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore