CVE-2026-45300

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-45300", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-11T20:14:43.202Z", "datePublished": "2026-06-05T19:32:43.547Z", "dateUpdated": "2026-06-08T16:34:10.203Z"}, "containers": {"cna": {"title": "async-http-client: Cookie header not stripped on cross-origin redirect", "problemTypes": [{"descriptions": [{"cweId": "CWE-200", "lang": "en", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-fmxf-pm6p-7xgm", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-fmxf-pm6p-7xgm"}, {"name": "https://github.com/AsyncHttpClient/async-http-client/commit/3b0e3e9e", "tags": ["x_refsource_MISC"], "url": "https://github.com/AsyncHttpClient/async-http-client/commit/3b0e3e9e"}, {"name": "https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.10", "tags": ["x_refsource_MISC"], "url": "https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.10"}], "affected": [{"vendor": "AsyncHttpClient", "product": "async-http-client", "versions": [{"version": ">= 3.0.0.Beta1, < 3.0.10", "status": "affected"}, {"version": ">= 2.0.0, < 2.15.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-05T19:32:43.547Z"}, "descriptions": [{"lang": "en", "value": "The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Versions on the 2.x branch prior to 2.15.0 and the 3.x branch prior to 3.0.10 leak `Cookie` headers to cross-origin redirect targets. When following a redirect to a different origin, the `propagatedHeaders()` method in `Redirect30xInterceptor.java` strips `Authorization` and `Proxy-Authorization` headers but does not strip the `Cookie` header, causing session cookies and other sensitive cookie values to be sent to attacker-controlled servers. Versions 2.15.0 and 3.0.10 patch the issue."}], "source": {"advisory": "GHSA-fmxf-pm6p-7xgm", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-fmxf-pm6p-7xgm", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-08T14:33:01.603361Z", "id": "CVE-2026-45300", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-08T16:34:10.203Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-45300", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-08T14:33:01.603361Z"}}}], "references": [{"url": "https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-fmxf-pm6p-7xgm", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-08T14:33:16.422Z"}}], "cna": {"title": "async-http-client: Cookie header not stripped on cross-origin redirect", "source": {"advisory": "GHSA-fmxf-pm6p-7xgm", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "AsyncHttpClient", "product": "async-http-client", "versions": [{"status": "affected", "version": ">= 3.0.0.Beta1, < 3.0.10"}, {"status": "affected", "version": ">= 2.0.0, < 2.15.0"}]}], "references": [{"url": "https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-fmxf-pm6p-7xgm", "name": "https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-fmxf-pm6p-7xgm", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/AsyncHttpClient/async-http-client/commit/3b0e3e9e", "name": "https://github.com/AsyncHttpClient/async-http-client/commit/3b0e3e9e", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.10", "name": "https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.10", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Versions on the 2.x branch prior to 2.15.0 and the 3.x branch prior to 3.0.10 leak `Cookie` headers to cross-origin redirect targets. When following a redirect to a different origin, the `propagatedHeaders()` method in `Redirect30xInterceptor.java` strips `Authorization` and `Proxy-Authorization` headers but does not strip the `Cookie` header, causing session cookies and other sensitive cookie values to be sent to attacker-controlled servers. Versions 2.15.0 and 3.0.10 patch the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-05T19:32:43.547Z"}}}, "cveMetadata": {"cveId": "CVE-2026-45300", "state": "PUBLISHED", "dateUpdated": "2026-06-08T16:34:10.203Z", "dateReserved": "2026-05-11T20:14:43.202Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-05T19:32:43.547Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "async-http-client", "vendor": "AsyncHttpClient", "versions": [{"status": "affected", "version": ">= 3.0.0.Beta1, < 3.0.10"}, {"status": "affected", "version": ">= 2.0.0, < 2.15.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:asynchttpclient_project:async-http-client:*:*:*:*:*:*:*:*", "matchCriteriaId": "AF0C317B-18A8-406E-BFF2-0EE6DA050379", "versionEndExcluding": "2.15.0", "versionStartIncluding": "2.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:asynchttpclient_project:async-http-client:*:*:*:*:*:*:*:*", "matchCriteriaId": "BD280C21-CB2D-4169-ABD1-CBF918370B32", "versionEndExcluding": "3.0.10", "versionStartIncluding": "3.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Versions on the 2.x branch prior to 2.15.0 and the 3.x branch prior to 3.0.10 leak `Cookie` headers to cross-origin redirect targets. When following a redirect to a different origin, the `propagatedHeaders()` method in `Redirect30xInterceptor.java` strips `Authorization` and `Proxy-Authorization` headers but does not strip the `Cookie` header, causing session cookies and other sensitive cookie values to be sent to attacker-controlled servers. Versions 2.15.0 and 3.0.10 patch the issue."}, {"lang": "es", "value": "La biblioteca AsyncHttpClient (AHC) permite a las aplicaciones Java ejecutar f\u00e1cilmente solicitudes HTTP y procesar asincr\u00f3nicamente respuestas HTTP. Las versiones de la rama 2.x anteriores a la 2.15.0 y de la rama 3.x anteriores a la 3.0.10 filtran encabezados 'Cookie' a destinos de redirecci\u00f3n de origen cruzado. Al seguir una redirecci\u00f3n a un origen diferente, el m\u00e9todo 'propagatedHeaders()' en 'Redirect30xInterceptor.java' elimina los encabezados 'Authorization' y 'Proxy-Authorization' pero no elimina el encabezado 'Cookie', lo que provoca que las cookies de sesi\u00f3n y otros valores de cookie sensibles se env\u00eden a servidores controlados por el atacante. Las versiones 2.15.0 y 3.0.10 corrigen el problema."}], "id": "CVE-2026-45300", "lastModified": "2026-07-23T07:10:00.113", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.0, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-45300", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-08T14:33:01.603361Z", "version": "2.0.3"}}]}, "published": "2026-06-05T20:17:31.893", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/AsyncHttpClient/async-http-client/commit/3b0e3e9e"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.10"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Patch", "Vendor Advisory"], "url": "https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-fmxf-pm6p-7xgm"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Mitigation", "Patch", "Vendor Advisory"], "url": "https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-fmxf-pm6p-7xgm"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[3.0.0.Beta1,3.0.10)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.0.0,2.15.0)"}}], "enrichment": {"confidence": 89.0, "confidence_source": "matching", "scores": [{"score": 89.0, "source": "matching"}]}, "original": {"product": "async-http-client", "source": "cna", "vendor": "AsyncHttpClient"}, "product": "async-http-client", "vendor": "asynchttpclient_project"}], "created": "2026-06-05T22:15:06.149244+00:00", "updated": "2026-06-07T11:00:11.201368+00:00", "vendors": ["asynchttpclient_project", "asynchttpclient_project$PRODUCT$async-http-client"]}