From 6903aa7d57c2ad6f111bb9c191d24bfd1166df23 Mon Sep 17 00:00:00 2001
From: Lari Hotari <lhotari@apache.org>
Date: Mon, 31 Aug 2026 11:24:19 +0300
Subject: [PATCH] [fix][sec] Upgrade async-http-client to 2.16.1

Upgrades org.asynchttpclient:async-http-client from 2.15.0 to 2.16.1.

2.16.0 fixes GHSA-m452-q8c9-rg2f (Set-Cookie domain not validated against
the request host). 2.16.1 fixes 14 further advisories, covering proxy and
CONNECT credential leaks, WebSocket handshake and proxy credential
handling, Digest authentication weaknesses, cookie public-suffix
validation, connection pool key scoping and unbounded HTTP/1.1 response
decompression.

The transitive dependency set is unchanged: reactive-streams stays at
1.0.4 and netty-reactive-streams at 2.0.6, and Pulsar continues to pin
Netty at 4.1.137.Final, above the 4.1.136.Final that async-http-client
2.16.1 declares.
---
 distribution/server/src/assemble/LICENSE.bin.txt | 4 ++--
 distribution/shell/src/assemble/LICENSE.bin.txt  | 4 ++--
 pom.xml                                          | 2 +-
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/distribution/server/src/assemble/LICENSE.bin.txt b/distribution/server/src/assemble/LICENSE.bin.txt
index 3bafc226ade3f..b9e48858620d6 100644
--- a/distribution/server/src/assemble/LICENSE.bin.txt
+++ b/distribution/server/src/assemble/LICENSE.bin.txt
@@ -390,8 +390,8 @@ The Apache Software License, Version 2.0
  * AirCompressor
     - io.airlift-aircompressor-2.0.3.jar
  * AsyncHttpClient
-    - org.asynchttpclient-async-http-client-2.15.0.jar
-    - org.asynchttpclient-async-http-client-netty-utils-2.15.0.jar
+    - org.asynchttpclient-async-http-client-2.16.1.jar
+    - org.asynchttpclient-async-http-client-netty-utils-2.16.1.jar
  * Jetty
     - org.eclipse.jetty-jetty-alpn-client-12.1.12.jar
     - org.eclipse.jetty-jetty-alpn-conscrypt-server-12.1.12.jar
diff --git a/distribution/shell/src/assemble/LICENSE.bin.txt b/distribution/shell/src/assemble/LICENSE.bin.txt
index b434c44be9be2..a7064138b1b66 100644
--- a/distribution/shell/src/assemble/LICENSE.bin.txt
+++ b/distribution/shell/src/assemble/LICENSE.bin.txt
@@ -398,8 +398,8 @@ The Apache Software License, Version 2.0
   * AirCompressor
      - aircompressor-2.0.3.jar
  * AsyncHttpClient
-    - async-http-client-2.15.0.jar
-    - async-http-client-netty-utils-2.15.0.jar
+    - async-http-client-2.16.1.jar
+    - async-http-client-netty-utils-2.16.1.jar
  * Jetty
     - jetty-alpn-client-12.1.12.jar
     - jetty-client-12.1.12.jar
diff --git a/pom.xml b/pom.xml
index d5726190f96bc..b868f8340bc3c 100644
--- a/pom.xml
+++ b/pom.xml
@@ -264,7 +264,7 @@ flexible messaging model and an intuitive client API.</description>
     <prometheus-jmx.version>0.16.1</prometheus-jmx.version>
     <confluent.version>8.1.1</confluent.version>
     <aircompressor.version>2.0.3</aircompressor.version>
-    <asynchttpclient.version>2.15.0</asynchttpclient.version>
+    <asynchttpclient.version>2.16.1</asynchttpclient.version>
     <commons-lang3.version>3.19.0</commons-lang3.version>
     <commons-io.version>2.22.0</commons-io.version>
     <commons-codec.version>1.22.0</commons-codec.version>