High 7.4Published Jun 5, 2026

CVE-2026-45300async-http-client: Cookie header not stripped on cross-origin redirect

Updated under an hour ago (Oct 27, 2026, 8:50 AM ET)

Does this affect you?

It affects AsyncHttpClient async-http-client and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for AsyncHttpClient async-http-client

Exploited in the last 30 days

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Versions on the 2.x branch prior to 2.15.0 and the 3.x branch prior to 3.0.10 leak `Cookie` headers to cross-origin redirect targets. When following a redirect to a different origin, the `propagatedHeaders()` method in `Redirect30xInterceptor.java` strips `Authorization` and `Proxy-Authorization` headers but does not strip the `Cookie` header, causing session cookies and other sensitive cookie values to be sent to attacker-controlled servers. Versions 2.15.0 and 3.0.10 patch the issue.

CVSS: 7.4 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Weakness (CWE): CWE-200
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: GitHub_M
NVD analysis: Analyzed
Record last updated: Jun 8, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

AsyncHttpClient async-http-client asynchttpclient:async_http_client (from the name)	from 3.0.0.Beta1, < 3.0.10; from 2.0.0, < 2.15.0	CNA record
asynchttpclient_project async-http-client asynchttpclient_project:async-http-client	from 2.0.0 before 2.15.0; from 3.0.0 before 3.0.10	NVD

References

References

https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-fmxf-pm6p-7xgm	x-refsource-confirm, exploit, mitigation, patch, vendor-advisory
https://github.com/AsyncHttpClient/async-http-client/commit/3b0e3e9e	x-refsource-misc, patch
https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.10	x-refsource-misc, product, release-notes

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.