CVE-2023-0040: Versions of Async HTTP Client prior to 1.13.2 are vulnerable to a form of targeted request manipulation called

This month

HIGH 7.5REMOTEUPGRADE

CVE-2023-0040 is a high-severity flaw (CVSS 7.5) affecting async-http-client. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Versions of Async HTTP Client prior to 1.13.2 are vulnerable to a form of targeted request manipulation called CRLF injection. This vulnerability was the result of insufficient validation of HTTP header field values before sending them to the network. Users are vulnerable if they pass untrusted data into HTTP header field values without prior sanitisation. Common use-cases here might be to place usernames from a database into HTTP header fields.

Why this priority

High severity
Remotely exploitable, no login, no user action

A fixed release or distro patch exists.

Risk facts

CVSS score	7.5 (High)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	None
EPSS exploit chance	0.6% (top 53%)
CISA exploited list	No
Weakness	CWE-93, CWE-74
Published	2023-01-18
Last modified	2026-06-17

Publisher (CNA): Swift Project · Vendor: asynchttpclient project

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2023-01-18 19:15 UTCPublished CVE record published
2026-06-17 05:24 UTCUpdated Record last modified

asynchttpclient project async-http-client UPGRADE

Affected: < 1.4.1 · >= 1.5.0 and < 1.9.1 · >= 1.10.0 and < 1.12.1 · >= 1.13.0 and < 1.13.2

Fixed in: 1.4.1, 1.9.1, 1.12.1, 1.13.2

Safe to downgrade to: a release before 1.5.0

1. Check installed version

apt-cache policy async-http-client || rpm -q async-http-client || async-http-client --version

2. UPGRADE to 1.4.1 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade async-http-client

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade async-http-client

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

3. If no update is available yet, DOWNGRADE to a release before 1.5.0 (Debian / Ubuntu)

apt-cache madison async-http-client sudo apt install async-http-client=<VERSION_BEFORE_1.5.0> sudo apt-mark hold async-http-client

3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list async-http-client sudo dnf downgrade async-http-client-<VERSION_BEFORE_1.5.0> sudo dnf versionlock add async-http-client

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2023-0040?

async-http-client: upgrade to 1.4.1, 1.9.1, 1.12.1, 1.13.2. Exact commands for each OS are on this page.

Is CVE-2023-0040 being exploited?

CVE-2023-0040 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2023-0040 affect?

CVE-2023-0040 affects async-http-client. Severity is high (CVSS 7.5). Versions of Async HTTP Client prior to 1.13.2 are vulnerable to a form of targeted request manipulation called CRLF injection. This vulnerability was the result of insufficient validation of HTTP header field values before sending them to t

How urgent is CVE-2023-0040?

Priority 43/100. High severity; Remotely exploitable, no login, no user action

Related CVEs

CVE-2026-45300 HIGH 7.4 UPGRADE The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously
CVE-2017-14063 HIGH 7.5 UPGRADE Async Http Client (aka async-http-client) before 2.0.35 can be tricked into connecting to a host different fro
CVE-2013-7398 MEDIUM 4.3 UPGRADE UPGRADE main/java/com/ning/http/client/AsyncHttpClientConfig.java in Async Http Client (aka AHC or async-http-client)
CVE-2013-7397 MEDIUM 4.3 UPGRADE UPGRADE Async Http Client (aka AHC or async-http-client) before 1.9.0 skips X.509 certificate verification unless both

References

← Back to latest CVEs