PT-2026-41727 · Unknown · Async Http Client

Published 2026-05-18 · Updated 2026-05-18 · CVE-2026-45300

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions async-http-client versions prior to 2.15.0 async-http-client versions prior to 3.0.10

Description An information disclosure issue exists where Cookie headers are leaked to cross-origin redirect targets. When following a redirect across a security boundary, such as a different origin or an HTTPS to HTTP downgrade, the propagatedHeaders() function in Redirect30xInterceptor.java fails to strip Cookie headers. While Authorization and Proxy-Authorization headers are removed, session cookies and other sensitive values are forwarded to the redirect target, which could be attacker-controlled. This can lead to session hijacking, CSRF token theft, API key theft, and privacy leaks.

Recommendations Update to version 2.15.0 or later. Update to version 3.0.10 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-45300

GHSA-FMXF-PM6P-7XGM

Affected Products

Async Http Client

References · 6

• https://osv.dev/vulnerability/GHSA-fmxf-pm6p-7xgm · Vendor Advisory
• https://github.com/AsyncHttpClient/async-http-client · Note
• https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.10 · Note
• https://twitter.com/dailycve/status/2056431673705717844 · Twitter Post
• https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-fmxf-pm6p-7xgm · Note
• https://github.com/AsyncHttpClient/async-http-client/commit/3b0e3e9e · Note