CVE-2026-45300

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Versions on the 2.x branch prior to 2.15.0 and the 3.x branch prior to 3.0.10 leak `Cookie` headers to cross-origin redirect targets. When following a redirect to a different origin, the `propagatedHeaders()` method in `Redirect30xInterceptor.java` strips `Authorization` and `Proxy-Authorization` headers but does not strip the `Cookie` header, causing session cookies and other sensitive cookie values to be sent to attacker-controlled servers. Versions 2.15.0 and 3.0.10 patch the issue.

• CWE-200

• https://github.com/AsyncHttpClient/async-http-client/commit/3b0e3e9ePatch
• https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.10Product, Release Notes
• https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-fmxf-pm6p-7xgmExploit, Mitigation, Patch, Vendor Advisory
• https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-fmxf-pm6p-7xgmExploit, Mitigation, Patch, Vendor Advisory

Published

Jun 5, 2026

Last Modified

Jul 23, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-45295FreeScout is a free help desk and shared inbox built with PH…6.5
• CVE-2026-45296OpenReplay is a self-hosted session replay suite. Prior to 1…7.7
• CVE-2026-45297OpenReplay is a self-hosted session replay suite. Prior to 1…5.3
• CVE-2026-45298Dozzle is a realtime log viewer for docker containers. Prior…8.6
• CVE-2026-45299Open WebUI is a self-hosted artificial intelligence platform…5.4
• CVE-2026-4530A security flaw has been discovered in apconw Aix-DB up to 1…5.3
• CVE-2026-45301Open WebUI is a self-hosted artificial intelligence platform…8.1
• CVE-2026-45302parse-nested-form-data is a tiny node module for parsing For…8.2
• CVE-2026-45303Open WebUI is a self-hosted artificial intelligence platform…7.7
• CVE-2026-45304Symfony is a PHP framework for web and console applications …7.5
• CVE-2026-45305Symfony is a PHP framework for web and console applications …7.5
• CVE-2026-45306pyLoad is a free and open-source download manager written in…6.5