CVE-2026-45300

HighCVSS 7.4

Published: 05/06/2026(UTC)Updated: 23/07/2026(UTC)Translated: 24/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.32%

24th percentile - higher than 24% of all known CVEs

Summary

The AsyncHttpClient (AHC) library versions 2.x before 2.15.0 and 3.x before 3.0.10 leak Cookie headers to cross-origin redirect targets. During a redirect to a different origin, the Cookie header is not stripped, allowing session cookies to be sent to attacker-controlled servers. Fixed in versions 2.15.0 and 3.0.10.

Risk Assessment

An attacker can intercept user session cookies, enabling session hijacking and access to sensitive data.

Recommendation

Update the AsyncHttpClient library to version 2.15.0 (for 2.x branch) or 3.0.10 (for 3.x branch).

Other vulnerabilities in AsyncHttpClient

CVE-2026-55688Medium
The AsyncHttpClient (AHC) library versions 2.0.0 through 2.15.0 and 3.0.0.Beta1 through 3.0.10 have a vulnerability in ThreadSafeCookieStore that does not verify whether the responding host is allowed to set a cookie for a domain. This allows an attacker-controlled host to inject a cookie for an unrelated domain, which the client then sends to that domain.

Original NVD description (English source)

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Versions on the 2.x branch prior to 2.15.0 and the 3.x branch prior to 3.0.10 leak `Cookie` headers to cross-origin redirect targets. When following a redirect to a different origin, the `propagatedHeaders()` method in `Redirect30xInterceptor.java` strips `Authorization` and `Proxy-Authorization` headers but does not strip the `Cookie` header, causing session cookies and other sensitive cookie values to be sent to attacker-controlled servers. Versions 2.15.0 and 3.0.10 patch the issue.