High severity · published Jun 5, 2026
CVE-2026-45300
async-http-client: Cookie header not stripped on cross-origin redirect
7.4
CVSS
0.4%
EPSS
No
On KEV
Description
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Versions on the 2.x branch prior to 2.15.0 and the 3.x branch prior to 3.0.10 leak `Cookie` headers to cross-origin redirect targets. When following a redirect to a different origin, the `propagatedHeaders()` method in `Redirect30xInterceptor.java` strips `Authorization` and `Proxy-Authorization` headers but does not strip the `Cookie` header, causing session cookies and other sensitive cookie values to be sent to attacker-controlled servers. Versions 2.15.0 and 3.0.10 patch the issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AS
async-http-client · AsyncHttpClient
>= 3.0.0.Beta1, < 3.0.10; >= 2.0.0, < 2.15.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-45300
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-45300
Patch
https://github.com/AsyncHttpClient/async-http-client/commit/3b0e3e9e
Product
https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.10
Exploit
https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-fmxf-pm6p-7xgm
More from async-http-client
9.4
CVE-2026-107282
AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host
8.8
CVE-2026-107279
AsyncHttpClient: Digest mutual authentication is switched off by a peer offering qop=auth-int
8.7
CVE-2026-107231
AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext
7.6
CVE-2026-107281
AsyncHttpClient: Connection pool key omits the authenticated principal, so an NTLM or Negotiate connection is reused across identities
7.5
CVE-2026-107232
AsyncHttpClient: Origin credentials sent in cleartext to a proxy that rejects the CONNECT