CVE-2026-45300 (GCVE-0-2026-45300)

Vulnerability from cvelistv5 – Published: 2026-06-05 19:32 – Updated: 2026-06-08 16:34
VLAI
Title
async-http-client: Cookie header not stripped on cross-origin redirect
Summary
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Versions on the 2.x branch prior to 2.15.0 and the 3.x branch prior to 3.0.10 leak `Cookie` headers to cross-origin redirect targets. When following a redirect to a different origin, the `propagatedHeaders()` method in `Redirect30xInterceptor.java` strips `Authorization` and `Proxy-Authorization` headers but does not strip the `Cookie` header, causing session cookies and other sensitive cookie values to be sent to attacker-controlled servers. Versions 2.15.0 and 3.0.10 patch the issue.
Severity
7.4 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
SSVC
Exploitation: poc Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
  • CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
Impacted products
Vendor Product Version
AsyncHttpClient async-http-client Affected: >= 3.0.0.Beta1, < 3.0.10
Affected: >= 2.0.0, < 2.15.0
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-45300",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-08T14:33:01.603361Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-08T16:34:10.203Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-fmxf-pm6p-7xgm"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "async-http-client",
          "vendor": "AsyncHttpClient",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.0.0.Beta1, \u003c 3.0.10"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.0.0, \u003c 2.15.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Versions on the 2.x branch prior to 2.15.0 and the 3.x branch prior to 3.0.10 leak `Cookie` headers to cross-origin redirect targets. When following a redirect to a different origin, the `propagatedHeaders()` method in `Redirect30xInterceptor.java` strips `Authorization` and `Proxy-Authorization` headers but does not strip the `Cookie` header, causing session cookies and other sensitive cookie values to be sent to attacker-controlled servers. Versions 2.15.0 and 3.0.10 patch the issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-05T19:32:43.547Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-fmxf-pm6p-7xgm",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-fmxf-pm6p-7xgm"
        },
        {
          "name": "https://github.com/AsyncHttpClient/async-http-client/commit/3b0e3e9e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/AsyncHttpClient/async-http-client/commit/3b0e3e9e"
        },
        {
          "name": "https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.10",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.10"
        }
      ],
      "source": {
        "advisory": "GHSA-fmxf-pm6p-7xgm",
        "discovery": "UNKNOWN"
      },
      "title": "async-http-client: Cookie header not stripped on cross-origin redirect"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-45300",
    "datePublished": "2026-06-05T19:32:43.547Z",
    "dateReserved": "2026-05-11T20:14:43.202Z",
    "dateUpdated": "2026-06-08T16:34:10.203Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-45300",
      "date": "2026-07-22",
      "epss": "0.00322",
      "percentile": "0.24493"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-45300\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-06-05T20:17:31.893\",\"lastModified\":\"2026-07-23T07:10:00.113\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Versions on the 2.x branch prior to 2.15.0 and the 3.x branch prior to 3.0.10 leak `Cookie` headers to cross-origin redirect targets. When following a redirect to a different origin, the `propagatedHeaders()` method in `Redirect30xInterceptor.java` strips `Authorization` and `Proxy-Authorization` headers but does not strip the `Cookie` header, causing session cookies and other sensitive cookie values to be sent to attacker-controlled servers. Versions 2.15.0 and 3.0.10 patch the issue.\"},{\"lang\":\"es\",\"value\":\"La biblioteca AsyncHttpClient (AHC) permite a las aplicaciones Java ejecutar f\u00e1cilmente solicitudes HTTP y procesar asincr\u00f3nicamente respuestas HTTP. Las versiones de la rama 2.x anteriores a la 2.15.0 y de la rama 3.x anteriores a la 3.0.10 filtran encabezados \u0027Cookie\u0027 a destinos de redirecci\u00f3n de origen cruzado. Al seguir una redirecci\u00f3n a un origen diferente, el m\u00e9todo \u0027propagatedHeaders()\u0027 en \u0027Redirect30xInterceptor.java\u0027 elimina los encabezados \u0027Authorization\u0027 y \u0027Proxy-Authorization\u0027 pero no elimina el encabezado \u0027Cookie\u0027, lo que provoca que las cookies de sesi\u00f3n y otros valores de cookie sensibles se env\u00eden a servidores controlados por el atacante. Las versiones 2.15.0 y 3.0.10 corrigen el problema.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"AsyncHttpClient\",\"product\":\"async-http-client\",\"versions\":[{\"version\":\"\u003e= 3.0.0.Beta1, \u003c 3.0.10\",\"status\":\"affected\"},{\"version\":\"\u003e= 2.0.0, \u003c 2.15.0\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N\",\"baseScore\":7.4,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":4.0}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-06-08T14:33:01.603361Z\",\"id\":\"CVE-2026-45300\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-200\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:asynchttpclient_project:async-http-client:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.0.0\",\"versionEndExcluding\":\"2.15.0\",\"matchCriteriaId\":\"AF0C317B-18A8-406E-BFF2-0EE6DA050379\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:asynchttpclient_project:async-http-client:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.0.0\",\"versionEndExcluding\":\"3.0.10\",\"matchCriteriaId\":\"BD280C21-CB2D-4169-ABD1-CBF918370B32\"}]}]}],\"references\":[{\"url\":\"https://github.com/AsyncHttpClient/async-http-client/commit/3b0e3e9e\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.10\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Product\",\"Release Notes\"]},{\"url\":\"https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-fmxf-pm6p-7xgm\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Mitigation\",\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-fmxf-pm6p-7xgm\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"tags\":[\"Exploit\",\"Mitigation\",\"Patch\",\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-45300\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-08T14:33:01.603361Z\"}}}], \"references\": [{\"url\": \"https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-fmxf-pm6p-7xgm\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-08T14:33:16.422Z\"}}], \"cna\": {\"title\": \"async-http-client: Cookie header not stripped on cross-origin redirect\", \"source\": {\"advisory\": \"GHSA-fmxf-pm6p-7xgm\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 7.4, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"AsyncHttpClient\", \"product\": \"async-http-client\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 3.0.0.Beta1, \u003c 3.0.10\"}, {\"status\": \"affected\", \"version\": \"\u003e= 2.0.0, \u003c 2.15.0\"}]}], \"references\": [{\"url\": \"https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-fmxf-pm6p-7xgm\", \"name\": \"https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-fmxf-pm6p-7xgm\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/AsyncHttpClient/async-http-client/commit/3b0e3e9e\", \"name\": \"https://github.com/AsyncHttpClient/async-http-client/commit/3b0e3e9e\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.10\", \"name\": \"https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.10\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Versions on the 2.x branch prior to 2.15.0 and the 3.x branch prior to 3.0.10 leak `Cookie` headers to cross-origin redirect targets. When following a redirect to a different origin, the `propagatedHeaders()` method in `Redirect30xInterceptor.java` strips `Authorization` and `Proxy-Authorization` headers but does not strip the `Cookie` header, causing session cookies and other sensitive cookie values to be sent to attacker-controlled servers. Versions 2.15.0 and 3.0.10 patch the issue.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-200\", \"description\": \"CWE-200: Exposure of Sensitive Information to an Unauthorized Actor\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-06-05T19:32:43.547Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-45300\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-06-08T16:34:10.203Z\", \"dateReserved\": \"2026-05-11T20:14:43.202Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-06-05T19:32:43.547Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.