CVE-2026-45300: Async-HTTP-Client Information Disclosure

CVE-2026-45300 Overview

CVE-2026-45300 affects the AsyncHttpClient (AHC) library, a Java HTTP client used to execute requests and process responses asynchronously. The vulnerability leaks Cookie headers to cross-origin redirect targets. When the client follows a redirect to a different origin, the propagatedHeaders() method in Redirect30xInterceptor.java strips Authorization and Proxy-Authorization headers but fails to strip the Cookie header. Session cookies and other sensitive cookie values are forwarded to attacker-controlled servers. The flaw is classified as an information disclosure issue [CWE-200] and is patched in versions 2.15.0 and 3.0.10.

Critical Impact
Session cookies leak to attacker-controlled hosts when applications follow HTTP redirects across origins, enabling session hijacking and account takeover.

Affected Products

AsyncHttpClient 2.x versions prior to 2.15.0
AsyncHttpClient 3.x versions prior to 3.0.10
Java applications consuming the asynchttpclient_project:async-http-client component

Discovery Timeline

2026-06-05 - CVE-2026-45300 published to NVD
2026-06-08 - Last updated in NVD database

Technical Details for CVE-2026-45300

Vulnerability Analysis

The AsyncHttpClient library transparently follows HTTP 3xx redirects when redirect handling is enabled. During this process, the Redirect30xInterceptor class rebuilds the outbound request and decides which headers from the original request should be propagated to the redirect target. The implementation removes credentials carried in Authorization and Proxy-Authorization headers when the redirect crosses origins, but it does not apply the same rule to the Cookie header. Cookies attached by the application or set during the session are forwarded to the new host, regardless of the original cookie scope. An attacker who controls a redirect target receives any cookies the calling application included with the initial request.

Root Cause

The root cause is incomplete header filtering in propagatedHeaders() within Redirect30xInterceptor.java. The method enumerates a denylist of sensitive headers but omits Cookie. Browsers enforce same-origin cookie scoping through the Domain and Path attributes, but the AHC client constructs outbound requests directly and does not consult cookie scope rules during redirect propagation. Any cookie set by the caller on the original request object is replayed verbatim on the redirected request.

Attack Vector

Exploitation requires the target application to issue an authenticated HTTP request through AHC to a server the attacker can influence. The attacker-controlled or compromised endpoint returns an HTTP 3xx response with a Location header pointing to an attacker-owned origin. AHC follows the redirect and resends the original Cookie header to the new host. The attacker captures the cookies from the inbound request and reuses them to impersonate the session. The vector is network-based and requires the application to act on the redirect, matching the user-interaction component reflected in the CVSS metrics.

No verified public proof-of-concept code is available. See the GitHub Security Advisory GHSA-fmxf-pm6p-7xgm and the fix commit for technical detail on the patched header filter.

Detection Methods for CVE-2026-45300

Indicators of Compromise

Outbound HTTP requests from application servers carrying Cookie headers to hosts outside the application's expected service inventory.
HTTP 3xx responses logged from upstream services where the Location header points to an unrelated external domain.
Session reuse from unfamiliar IP addresses or geolocations shortly after the application issued a cross-origin redirect.

Detection Strategies

Inventory Java services and scan build manifests (pom.xml, build.gradle) for async-http-client versions below 2.15.0 or 3.0.10.
Inspect egress proxy logs for AHC user agents reaching destinations not present in the documented integration list.
Correlate authentication anomalies with redirect activity originating from backend services that use AHC.

Monitoring Recommendations

Forward HTTP egress logs and application traces to a centralized analytics platform and alert on cross-origin redirect chains carrying session identifiers.
Track dependency changes in CI pipelines so vulnerable AHC versions are flagged before deployment.
Monitor session token usage patterns to detect concurrent use of the same cookie from disparate networks.

How to Mitigate CVE-2026-45300

Immediate Actions Required

Upgrade AsyncHttpClient to version 2.15.0 on the 2.x branch or 3.0.10 on the 3.x branch.
Rotate session cookies and API tokens for any service that issued AHC requests to untrusted upstream endpoints.
Audit application code paths that enable redirect following and confirm whether external hosts can be reached.

Patch Information

The maintainers released the fix in AsyncHttpClient 3.0.10 and the corresponding 2.15.0 release. The patch is documented in commit 3b0e3e9e, which extends propagatedHeaders() to strip the Cookie header on cross-origin redirects.

Workarounds

Disable automatic redirect following in AHC client configuration and handle 3xx responses explicitly in application code.
Strip the Cookie header from outbound requests when the target host is outside an allowlist of trusted origins.
Restrict cookie scope and lifetime to reduce the value of any leaked cookies, and prefer short-lived bearer tokens scoped to a single audience.

bash

# Maven dependency upgrade example
<dependency>
  <groupId>org.asynchttpclient</groupId>
  <artifactId>async-http-client</artifactId>
  <version>3.0.10</version>
</dependency>

# Gradle dependency upgrade example
implementation 'org.asynchttpclient:async-http-client:3.0.10'