{
  "affected": [
    {
      "affectedData": [
        {
          "product": "async-http-client",
          "vendor": "AsyncHttpClient",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.0.0.Beta1, \u003c 3.0.10"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.0.0, \u003c 2.15.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:asynchttpclient_project:async-http-client:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "AF0C317B-18A8-406E-BFF2-0EE6DA050379",
              "versionEndExcluding": "2.15.0",
              "versionStartIncluding": "2.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:asynchttpclient_project:async-http-client:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "BD280C21-CB2D-4169-ABD1-CBF918370B32",
              "versionEndExcluding": "3.0.10",
              "versionStartIncluding": "3.0.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Versions on the 2.x branch prior to 2.15.0 and the 3.x branch prior to 3.0.10 leak `Cookie` headers to cross-origin redirect targets. When following a redirect to a different origin, the `propagatedHeaders()` method in `Redirect30xInterceptor.java` strips `Authorization` and `Proxy-Authorization` headers but does not strip the `Cookie` header, causing session cookies and other sensitive cookie values to be sent to attacker-controlled servers. Versions 2.15.0 and 3.0.10 patch the issue."
    },
    {
      "lang": "es",
      "value": "La biblioteca AsyncHttpClient (AHC) permite a las aplicaciones Java ejecutar f\u00e1cilmente solicitudes HTTP y procesar asincr\u00f3nicamente respuestas HTTP. Las versiones de la rama 2.x anteriores a la 2.15.0 y de la rama 3.x anteriores a la 3.0.10 filtran encabezados \u0027Cookie\u0027 a destinos de redirecci\u00f3n de origen cruzado. Al seguir una redirecci\u00f3n a un origen diferente, el m\u00e9todo \u0027propagatedHeaders()\u0027 en \u0027Redirect30xInterceptor.java\u0027 elimina los encabezados \u0027Authorization\u0027 y \u0027Proxy-Authorization\u0027 pero no elimina el encabezado \u0027Cookie\u0027, lo que provoca que las cookies de sesi\u00f3n y otros valores de cookie sensibles se env\u00eden a servidores controlados por el atacante. Las versiones 2.15.0 y 3.0.10 corrigen el problema."
    }
  ],
  "id": "CVE-2026-45300",
  "lastModified": "2026-07-23T07:10:00.113",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.4,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 4.0,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-45300",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-06-08T14:33:01.603361Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-06-05T20:17:31.893",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/AsyncHttpClient/async-http-client/commit/3b0e3e9e"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Product",
        "Release Notes"
      ],
      "url": "https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.10"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Mitigation",
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-fmxf-pm6p-7xgm"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Mitigation",
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-fmxf-pm6p-7xgm"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}