Information disclosure in Asynchttpclient Async-Http-Client
CVE-2026-45300
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Versions on the 2.x branch prior to 2.15.0 and the 3.x branch prior to 3.0.10 leak `Cookie` headers to cross-origin redirect targets. When following a redirect to a different origin, the `propagatedHeaders()` method in `Redirect30xInterceptor.java` strips `Authorization` and `Proxy-Authorization` headers but does not strip the `Cookie` header, causing session cookies and other sensitive cookie values to be sent to attacker-controlled servers. Versions 2.15.0 and 3.0.10 patch the issue.
Vulnerability class: Information Disclosure
EPSS: 0.003 (24.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.4 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N.
Affected products
- Asynchttpclient Async-http-client — versions >= 3.0.0.Beta1, < 3.0.10, >= 2.0.0, < 2.15.0
- Asynchttpclient_project Async-http-client
Weakness classification (CWE)
References
- security-advisories@github.com (Patch, x_refsource_MISC)
- security-advisories@github.com (Product, x_refsource_MISC, Release Notes)
- security-advisories@github.com (x_refsource_CONFIRM, Exploit, Patch, Mitigation, Vendor Advisory)
Frequently asked questions
- What is CVE-2026-45300?
- CVE-2026-45300 is a high-severity vulnerability in Asynchttpclient Async-Http-Client, classified under Information Disclosure. CVSS score: 7.4/10. Published 2026-06-05.
- How severe is CVE-2026-45300?
- High severity. CVSS v3 base score is 7.4 out of 10.