Read the docs
TI-2026-33100 Aliases CVE-2026-45300GHSA-fmxf-pm6p-7xgm

async-http-client: Cookie header not stripped on cross-origin redirect

Priority HIGH 66CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Versions on the 2.x branch prior to 2.15.0 and the 3.x branch prior to 3.0.10 leak `Cookie` headers to cross-origin redirect targets. When following a redirect to a different origin, the `propagatedHeaders()` method in `Redirect30xInterceptor.java` strips `Authorization` and `Proxy-Authorization` headers but does not strip the `Cookie` header, causing session cookies and other sensitive cookie values to be sent to attacker-controlled servers. Versions 2.15.0 and 3.0.10 patch the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00399 34th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed async-http-client (AsyncHttpClient): 3.0.10, 2.15.0org.asynchttpclient:async-http-client (Maven): 3.0.10, 2.15.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AsyncHttpClientasync-http-client3.0.0.Beta1 to before 3.0.10; 2.0.0 to before 2.15.03.0.10, 2.15.0Patch availableCNA
—org.asynchttpclient:async-http-client (Maven)3.0.0.Beta1 to before 3.0.103.0.10Patch availableGHSA-fmxf-pm6p-7xgm
—org.asynchttpclient:async-http-client (Maven)2.0.0 to before 2.15.02.15.0Patch availableGHSA-fmxf-pm6p-7xgm
  • async-http-client VendorAsyncHttpClient Affected 3.0.0.Beta1 to before 3.0.10; 2.0.0 to before 2.15.0 Fixed in 3.0.10, 2.15.0 Patch available CNA
  • org.asynchttpclient:async-http-client (Maven) Vendor— Affected 3.0.0.Beta1 to before 3.0.10 Fixed in 3.0.10 Patch available GHSA-fmxf-pm6p-7xgm
  • org.asynchttpclient:async-http-client (Maven) Vendor— Affected 2.0.0 to before 2.15.0 Fixed in 2.15.0 Patch available GHSA-fmxf-pm6p-7xgm

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:asynchttpclient_project:async-http-client:*:*:*:*:*:*:*:*2.0.0 to before 2.15.0; 3.0.0 to before 3.0.10VulnerableAsynchttpclient Project
  • cpe:2.3:a:asynchttpclient_project:async-http-client:*:*:*:*:*:*:*:* Versions 2.0.0 to before 2.15.0; 3.0.0 to before 3.0.10 Vulnerable ·Asynchttpclient Project

Remediation

  • Fix · CNA async-http-client (AsyncHttpClient) Fixed in 3.0.10, 2.15.0
  • Fix · GHSA-fmxf-pm6p-7xgm org.asynchttpclient:async-http-client (Maven) Fixed in 3.0.10 Advisory →
  • Fix · GHSA-fmxf-pm6p-7xgm org.asynchttpclient:async-http-client (Maven) Fixed in 2.15.0 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat Fuse 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-45300
  2. 2026-10-03 Alias added: GHSA-fmxf-pm6p-7xgm
  3. 2026-10-26 Affected versions changed · Red Hat
  4. 2026-10-26 CVSS score added · Red Hat

References

Exploit 1

Patch 1

Advisory 1

Other 2

  • TI-2024-36149 AsyncHttpClient (AHC) library's `CookieStore` replaces explicitly defined `Cookie`s CVSS 4.0CRITICAL 9.2
  • TI-2026-69321 Cross-host replay in AsyncHttpClient leaks credentials to new host CVSS 4.0CRITICAL 9.4
  • TI-2026-69315 AsyncHttpClient sends passwords in cleartext after Digest downgrade CVSS 4.0HIGH 8.7
  • TI-2026-58825 AsyncHttpClient: Unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of service CVSS 3.1HIGH 7.5
  • TI-2026-69311 Unbounded WebSocket decompression in AsyncHttpClient enables DoS CVSS 3.1HIGH 7.5
  • TI-2026-58823 AsyncHttpClient: SOCKS proxy credentials sent to the origin server over plaintext HTTP CVSS 3.1HIGH 7.5
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences