CVE-2026-45300

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Versions on the 2.x branch prior to 2.15.0 and the 3.x branch prior to 3.0.10 leak `Cookie` headers to cross-origin redirect targets. When following a redirect to a different origin, the `propagatedHeaders()` method in `Redirect30xInterceptor.java` strips `Authorization` and `Proxy-Authorization` headers but does not strip the `Cookie` header, causing session cookies and other sensitive cookie values to be sent to attacker-controlled servers. Versions 2.15.0 and 3.0.10 patch the issue.

CVSS v3 7.4 HIGH

7.4^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/AsyncHttpClient/async-http-client/commit/3b0e3e9e	Patch
https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.10	Product Release Notes
https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-fmxf-pm6p-7xgm	Exploit Mitigation Patch Vendor Advisory
https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-fmxf-pm6p-7xgm	Exploit Mitigation Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:asynchttpclient_project:async-http-client::::::::
	cpe:2.3:a:asynchttpclient_project:async-http-client::::::::

History

No history.

Information

Published : 2026-06-05 20:17

Updated : 2026-07-23 07:10

NVD link : CVE-2026-45300

Mitre link : CVE-2026-45300

CVE.ORG link : CVE-2026-45300

JSON object : View

Products Affected

asynchttpclient_project

async-http-client

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2026-45300", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-45300", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-08T14:33:01.603361Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "AsyncHttpClient", "product": "async-http-client", "versions": [{"status": "affected", "version": ">= 3.0.0.Beta1, < 3.0.10"}, {"status": "affected", "version": ">= 2.0.0, < 2.15.0"}]}]}], "published": "2026-06-05T20:17:31.893", "references": [{"url": "https://github.com/AsyncHttpClient/async-http-client/commit/3b0e3e9e", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.10", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-fmxf-pm6p-7xgm", "tags": ["Exploit", "Mitigation", "Patch", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-fmxf-pm6p-7xgm", "tags": ["Exploit", "Mitigation", "Patch", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Versions on the 2.x branch prior to 2.15.0 and the 3.x branch prior to 3.0.10 leak `Cookie` headers to cross-origin redirect targets. When following a redirect to a different origin, the `propagatedHeaders()` method in `Redirect30xInterceptor.java` strips `Authorization` and `Proxy-Authorization` headers but does not strip the `Cookie` header, causing session cookies and other sensitive cookie values to be sent to attacker-controlled servers. Versions 2.15.0 and 3.0.10 patch the issue."}, {"lang": "es", "value": "La biblioteca AsyncHttpClient (AHC) permite a las aplicaciones Java ejecutar f\u00e1cilmente solicitudes HTTP y procesar asincr\u00f3nicamente respuestas HTTP. Las versiones de la rama 2.x anteriores a la 2.15.0 y de la rama 3.x anteriores a la 3.0.10 filtran encabezados 'Cookie' a destinos de redirecci\u00f3n de origen cruzado. Al seguir una redirecci\u00f3n a un origen diferente, el m\u00e9todo 'propagatedHeaders()' en 'Redirect30xInterceptor.java' elimina los encabezados 'Authorization' y 'Proxy-Authorization' pero no elimina el encabezado 'Cookie', lo que provoca que las cookies de sesi\u00f3n y otros valores de cookie sensibles se env\u00eden a servidores controlados por el atacante. Las versiones 2.15.0 y 3.0.10 corrigen el problema."}], "lastModified": "2026-07-23T07:10:00.113", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:asynchttpclient_project:async-http-client:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AF0C317B-18A8-406E-BFF2-0EE6DA050379", "versionEndExcluding": "2.15.0", "versionStartIncluding": "2.0.0"}, {"criteria": "cpe:2.3:a:asynchttpclient_project:async-http-client:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BD280C21-CB2D-4169-ABD1-CBF918370B32", "versionEndExcluding": "3.0.10", "versionStartIncluding": "3.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}