CVE-2026-40490

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-40490", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-13T19:50:42.114Z", "datePublished": "2026-04-18T01:31:13.860Z", "dateUpdated": "2026-04-20T14:55:50.254Z"}, "containers": {"cna": {"title": "AsyncHttpClient leaks authorization credentials to untrusted domains on cross-origin redirects", "problemTypes": [{"descriptions": [{"cweId": "CWE-200", "lang": "en", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-cmxv-58fp-fm3g", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-cmxv-58fp-fm3g"}, {"name": "https://github.com/AsyncHttpClient/async-http-client/commit/6b2fbb7f8", "tags": ["x_refsource_MISC"], "url": "https://github.com/AsyncHttpClient/async-http-client/commit/6b2fbb7f8"}, {"name": "https://github.com/AsyncHttpClient/async-http-client/commit/ae557ad35246721c09dafb2976609cd0004e78ae", "tags": ["x_refsource_MISC"], "url": "https://github.com/AsyncHttpClient/async-http-client/commit/ae557ad35246721c09dafb2976609cd0004e78ae"}, {"name": "https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-2.14.5", "tags": ["x_refsource_MISC"], "url": "https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-2.14.5"}, {"name": "https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.9", "tags": ["x_refsource_MISC"], "url": "https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.9"}], "affected": [{"vendor": "AsyncHttpClient", "product": "async-http-client", "versions": [{"version": ">= 3.0.0.Beta1, < 3.0.9", "status": "affected"}, {"version": "< 2.14.5", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-18T01:31:13.860Z"}, "descriptions": [{"lang": "en", "value": "The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. When redirect following is enabled (followRedirect(true)), versions of AsyncHttpClient prior to 3.0.9 and 2.14.5 forward Authorization and Proxy-Authorization headers along with Realm credentials to arbitrary redirect targets regardless of domain, scheme, or port changes. This leaks credentials on cross-domain redirects and HTTPS-to-HTTP downgrades. Additionally, even when stripAuthorizationOnRedirect is set to true, the Realm object containing plaintext credentials is still propagated to the redirect request, causing credential re-generation for Basic and Digest authentication schemes via NettyRequestFactory. An attacker who controls a redirect target (via open redirect, DNS rebinding, or MITM on HTTP) can capture Bearer tokens, Basic auth credentials, or any other Authorization header value. The fix in versions 3.0.9 and 2.14.5 automatically strips Authorization and Proxy-Authorization headers and clears Realm credentials whenever a redirect crosses origin boundaries (different scheme, host, or port) or downgrades from HTTPS to HTTP. For users unable to upgrade, set `(stripAuthorizationOnRedirect(true))` in the client config and avoid using Realm-based authentication with redirect following enabled. Note that `(stripAuthorizationOnRedirect(true))` alone is insufficient on versions prior to 3.0.9 and 2.14.5 because the Realm bypass still re-generates credentials. Alternatively, disable redirect following (`followRedirect(false)`) and handle redirects manually with origin validation."}], "source": {"advisory": "GHSA-cmxv-58fp-fm3g", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-20T14:51:47.370455Z", "id": "CVE-2026-40490", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-20T14:55:50.254Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-40490", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-20T14:51:47.370455Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-20T14:51:48.455Z"}}], "cna": {"title": "AsyncHttpClient leaks authorization credentials to untrusted domains on cross-origin redirects", "source": {"advisory": "GHSA-cmxv-58fp-fm3g", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "AsyncHttpClient", "product": "async-http-client", "versions": [{"status": "affected", "version": ">= 3.0.0.Beta1, < 3.0.9"}, {"status": "affected", "version": "< 2.14.5"}]}], "references": [{"url": "https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-cmxv-58fp-fm3g", "name": "https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-cmxv-58fp-fm3g", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/AsyncHttpClient/async-http-client/commit/6b2fbb7f8", "name": "https://github.com/AsyncHttpClient/async-http-client/commit/6b2fbb7f8", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/AsyncHttpClient/async-http-client/commit/ae557ad35246721c09dafb2976609cd0004e78ae", "name": "https://github.com/AsyncHttpClient/async-http-client/commit/ae557ad35246721c09dafb2976609cd0004e78ae", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-2.14.5", "name": "https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-2.14.5", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.9", "name": "https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.9", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. When redirect following is enabled (followRedirect(true)), versions of AsyncHttpClient prior to 3.0.9 and 2.14.5 forward Authorization and Proxy-Authorization headers along with Realm credentials to arbitrary redirect targets regardless of domain, scheme, or port changes. This leaks credentials on cross-domain redirects and HTTPS-to-HTTP downgrades. Additionally, even when stripAuthorizationOnRedirect is set to true, the Realm object containing plaintext credentials is still propagated to the redirect request, causing credential re-generation for Basic and Digest authentication schemes via NettyRequestFactory. An attacker who controls a redirect target (via open redirect, DNS rebinding, or MITM on HTTP) can capture Bearer tokens, Basic auth credentials, or any other Authorization header value. The fix in versions 3.0.9 and 2.14.5 automatically strips Authorization and Proxy-Authorization headers and clears Realm credentials whenever a redirect crosses origin boundaries (different scheme, host, or port) or downgrades from HTTPS to HTTP. For users unable to upgrade, set `(stripAuthorizationOnRedirect(true))` in the client config and avoid using Realm-based authentication with redirect following enabled. Note that `(stripAuthorizationOnRedirect(true))` alone is insufficient on versions prior to 3.0.9 and 2.14.5 because the Realm bypass still re-generates credentials. Alternatively, disable redirect following (`followRedirect(false)`) and handle redirects manually with origin validation."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-18T01:31:13.860Z"}}}, "cveMetadata": {"cveId": "CVE-2026-40490", "state": "PUBLISHED", "dateUpdated": "2026-04-20T14:55:50.254Z", "dateReserved": "2026-04-13T19:50:42.114Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-18T01:31:13.860Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "async-http-client", "vendor": "AsyncHttpClient", "versions": [{"status": "affected", "version": ">= 3.0.0.Beta1, < 3.0.9"}, {"status": "affected", "version": "< 2.14.5"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. When redirect following is enabled (followRedirect(true)), versions of AsyncHttpClient prior to 3.0.9 and 2.14.5 forward Authorization and Proxy-Authorization headers along with Realm credentials to arbitrary redirect targets regardless of domain, scheme, or port changes. This leaks credentials on cross-domain redirects and HTTPS-to-HTTP downgrades. Additionally, even when stripAuthorizationOnRedirect is set to true, the Realm object containing plaintext credentials is still propagated to the redirect request, causing credential re-generation for Basic and Digest authentication schemes via NettyRequestFactory. An attacker who controls a redirect target (via open redirect, DNS rebinding, or MITM on HTTP) can capture Bearer tokens, Basic auth credentials, or any other Authorization header value. The fix in versions 3.0.9 and 2.14.5 automatically strips Authorization and Proxy-Authorization headers and clears Realm credentials whenever a redirect crosses origin boundaries (different scheme, host, or port) or downgrades from HTTPS to HTTP. For users unable to upgrade, set `(stripAuthorizationOnRedirect(true))` in the client config and avoid using Realm-based authentication with redirect following enabled. Note that `(stripAuthorizationOnRedirect(true))` alone is insufficient on versions prior to 3.0.9 and 2.14.5 because the Realm bypass still re-generates credentials. Alternatively, disable redirect following (`followRedirect(false)`) and handle redirects manually with origin validation."}], "id": "CVE-2026-40490", "lastModified": "2026-06-17T10:45:22.360", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 4.0, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40490", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-20T14:51:47.370455Z", "version": "2.0.3"}}]}, "published": "2026-04-18T02:16:11.977", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/AsyncHttpClient/async-http-client/commit/6b2fbb7f8"}, {"source": "security-advisories@github.com", "url": "https://github.com/AsyncHttpClient/async-http-client/commit/ae557ad35246721c09dafb2976609cd0004e78ae"}, {"source": "security-advisories@github.com", "url": "https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-2.14.5"}, {"source": "security-advisories@github.com", "url": "https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.9"}, {"source": "security-advisories@github.com", "url": "https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-cmxv-58fp-fm3g"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "async-http-client: AsyncHttpClient: Credential leakage via improper handling of authorization headers during redirects", "id": "2459390", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2459390"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-346", "details": ["The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. When redirect following is enabled (followRedirect(true)), versions of AsyncHttpClient prior to 3.0.9 and 2.14.5 forward Authorization and Proxy-Authorization headers along with Realm credentials to arbitrary redirect targets regardless of domain, scheme, or port changes. This leaks credentials on cross-domain redirects and HTTPS-to-HTTP downgrades. Additionally, even when stripAuthorizationOnRedirect is set to true, the Realm object containing plaintext credentials is still propagated to the redirect request, causing credential re-generation for Basic and Digest authentication schemes via NettyRequestFactory. An attacker who controls a redirect target (via open redirect, DNS rebinding, or MITM on HTTP) can capture Bearer tokens, Basic auth credentials, or any other Authorization header value. The fix in versions 3.0.9 and 2.14.5 automatically strips Authorization and Proxy-Authorization headers and clears Realm credentials whenever a redirect crosses origin boundaries (different scheme, host, or port) or downgrades from HTTPS to HTTP. For users unable to upgrade, set `(stripAuthorizationOnRedirect(true))` in the client config and avoid using Realm-based authentication with redirect following enabled. Note that `(stripAuthorizationOnRedirect(true))` alone is insufficient on versions prior to 3.0.9 and 2.14.5 because the Realm bypass still re-generates credentials. Alternatively, disable redirect following (`followRedirect(false)`) and handle redirects manually with origin validation.", "A flaw was found in AsyncHttpClient. When redirect following is enabled, the library improperly forwards Authorization and Proxy-Authorization headers, including Realm credentials, to arbitrary redirect targets regardless of domain, scheme, or port changes. An attacker who controls a redirect target can exploit this to capture sensitive credentials, such as Bearer tokens and Basic authentication credentials. This information disclosure occurs on cross-domain redirects and when downgrading from HTTPS to HTTP."], "name": "CVE-2026-40490", "package_state": [{"cpe": "cpe:/a:redhat:camel_spring_boot:4", "fix_state": "Fix deferred", "package_name": "org.asynchttpclient/async-http-client", "product_name": "Red Hat build of Apache Camel for Spring Boot 4"}, {"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Fix deferred", "package_name": "org.asynchttpclient/async-http-client", "product_name": "Red Hat Fuse 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7", "fix_state": "Fix deferred", "package_name": "org.asynchttpclient/async-http-client", "product_name": "Red Hat JBoss Enterprise Application Platform 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8", "fix_state": "Fix deferred", "package_name": "com.ning/async-http-client", "product_name": "Red Hat JBoss Enterprise Application Platform 8"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8", "fix_state": "Fix deferred", "package_name": "org.asynchttpclient/async-http-client", "product_name": "Red Hat JBoss Enterprise Application Platform 8"}, {"cpe": "cpe:/a:redhat:jbosseapxp", "fix_state": "Fix deferred", "package_name": "com.ning/async-http-client", "product_name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"}, {"cpe": "cpe:/a:redhat:jbosseapxp", "fix_state": "Fix deferred", "package_name": "org.asynchttpclient/async-http-client", "product_name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"}], "public_date": "2026-04-18T01:31:13Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-40490\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-40490\nhttps://github.com/AsyncHttpClient/async-http-client/commit/6b2fbb7f8\nhttps://github.com/AsyncHttpClient/async-http-client/commit/ae557ad35246721c09dafb2976609cd0004e78ae\nhttps://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-2.14.5\nhttps://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.9\nhttps://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-cmxv-58fp-fm3g"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[3.0.0.Beta1,3.0.9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.14.5)"}}], "enrichment": {"confidence": 89.0, "confidence_source": "matching", "scores": [{"score": 89.0, "source": "matching"}]}, "original": {"product": "async-http-client", "source": "cna", "vendor": "AsyncHttpClient"}, "product": "async-http-client", "vendor": "asynchttpclient_project"}], "analysis": {"en": {"generated_at": "2026-04-22T03:32:29.058887+00:00", "value": {"mitigation_remediation": ["Upgrade AsyncHttpClient to version 3.0.9 or 2.14.5 or later, where redirect handling automatically strips header credentials on origin change.", "If an upgrade is not immediately possible, configure the client with stripAuthorizationOnRedirect(true) and refrain from using Realm-based authentication when redirect following is enabled.", "Alternatively, disable automatic redirect following (followRedirect(false)) and implement manual redirect handling with strict origin validation."], "summary": {"action": "Patch Now", "impact": "Credential Disclosure"}, "threat_synthesis": {"affected_systems": "Java applications that use AsyncHttpClient async-http-client versions earlier than 3.0.9 or 2.14.5 and that enable redirect following are vulnerable. The issue exists in all projects that have not applied the fixed releases identified in the advisories.", "description_and_impact": "The AsyncHttpClient library, used to perform asynchronous HTTP requests, permits redirect following. When enabled, headers that contain credentials, including Authorization and Proxy-Authorization, as well as the Realm object holding plaintext credentials, are forwarded to any redirect target. This occurs even when the redirect crosses origin boundaries or degrades from HTTPS to HTTP. Consequently, an attacker who controls a redirect target can capture Bearer tokens, Basic authentication credentials, or other Authorization header values, leading to unauthorized disclosure.", "risk_and_exploitability": "The CVSS score of 6.8 indicates moderate severity, and the EPSS score of <1% indicates a low likelihood of exploitation. The vulnerability is not yet listed in CISA\u2019s KEV catalog. Based on the description, it is inferred that the primary attack vector is remote, exploiting HTTP redirects, open redirects, or other mechanisms that allow an attacker to control the redirect target. An adversary could obtain authentication tokens by redirecting client requests to a malicious server, potentially leading to credential compromise."}}}}, "created": "2026-04-18T08:45:41.380329+00:00", "updated": "2026-04-22T03:45:06.968800+00:00", "vendors": ["asynchttpclient_project", "asynchttpclient_project$PRODUCT$async-http-client"]}