CVE-2026-45300 async-http-client: Cookie header not stripped on cross-origin redirect

What is CVE-2026-45300?

CVE-2026-45300 is a high-severity vulnerability in AsyncHttpClient async-http-client, published on 5 Jun 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Versions on the 2.x branch prior to 2.15.0 and the 3.x branch prior to 3.0.10 leak `Cookie` headers to cross-origin redirect targets. When following a redirect to a different origin, the `propagatedHeaders()` method in `Redirect30xInterceptor.java` strips `Authorization` and `Proxy-Authorization` headers but does not strip the `Cookie` header, causing session cookies and other sensitive cookie values to be sent to attacker-controlled servers. Versions 2.15.0 and 3.0.10 patch the issue.

Weakness: CWE-200

Which versions are affected by CVE-2026-45300?

4 open source packages ship an affected version, including org.asynchttpclient:async-http-client. It affects 1 product.

Products include Asynchttpclient Project Async-Http-Client.

How do I fix CVE-2026-45300?

Upgrade org.asynchttpclient:async-http-client to a fixed version for your release line: 2.15.0 or 3.0.10.

Is CVE-2026-45300 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-45300 exists.

Other vulnerabilities in AsyncHttpClient async-http-client

• CVE-2023-0040 Async HTTP Client has CRLF Injection vulnerability in HTTP request headers High 7.5
• CVE-2017-14063 Improper Input Validation in async-http-client High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as CLEANSTART-2026-LW03100, CLEANSTART-2026-WW03960, ECHO-3fd2-6923-7358, GHSA-fmxf-pm6p-7xgm, MINI-2xp7-hq6r-pf29, MINI-m668-g893-3h3m and 2 more.