What’s Vulnerable › Vulnerabilities

CVE-2026-45300: async-http-client: Cookie header not stripped on cross-origin redirect

• Severity: high (CVSS 7.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-06-05 · updated 2026-07-23
• Weakness: CWE-200

Description

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Versions on the 2.x branch prior to 2.15.0 and the 3.x branch prior to 3.0.10 leak `Cookie` headers to cross-origin redirect targets. When following a redirect to a different origin, the `propagatedHeaders()` method in `Redirect30xInterceptor.java` strips `Authorization` and `Proxy-Authorization` headers but does not strip the `Cookie` header, causing session cookies and other sensitive cookie values to be sent to attacker-controlled servers. Versions 2.15.0 and 3.0.10 patch the issue.

Affected products

• AsyncHttpClient async-http-client: from 2.0.0 before 2.15.0; from 3.0.0 before 3.0.10 — fixed in 2.15.0, 3.0.10

How to fix

Upgrade to a fixed version: AsyncHttpClient async-http-client 2.15.0, 3.0.10. Check the vendor advisory for mitigations.

References

• https://github.com/AsyncHttpClient/async-http-client/commit/3b0e3e9e
• https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.10
• https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-fmxf-pm6p-7xgm
• https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-fmxf-pm6p-7xgm

Get alerted when CVE-2026-45300 or the next vulnerability affects your stack