CVE catalog
CVE-2026-45300
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Versions on the 2.x branch prior to 2.15.0 and the 3.x branch prio
- Severity
- High · CVSS 7.4
- Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.40% · Oct 25, 2026
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Versions on the 2.x branch prior to 2.15.0 and the 3.x branch prior to 3.0.10 leak `Cookie` headers to cross-origin redirect targets. When following a redirect to a different origin, the `propagatedHeaders()` method in `Redirect30xInterceptor.java` strips `Authorization` and `Proxy-Authorization` headers but does not strip the `Cookie` header, causing session cookies and other sensitive cookie values to be sent to attacker-controlled servers. Versions 2.15.0 and 3.0.10 patch the issue.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | async-http-client | sid | 2.12.3-1 | vulnerable |
| Debian | async-http-client | bookworm | 2.12.3-1 | not affected |
| Debian | async-http-client | bookworm-security | 2.12.3-1+deb12u1 | not affected |
| Cpe | async-http-client | Not reported | 2.15.0 | fixed |
| Cpe | async-http-client | Not reported | 3.0.10 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | async-http-client | source | sid | (unfixed) | not yet assigned | Not reported | [1139165] |
| Debian | async-http-client | source | bookworm | Not affected | unimportant | Not reported | [1139165] |
| Cpe | async-http-client | cpe | Not reported | 2.15.0 | Not reported | Not reported | Not reported |
| Cpe | async-http-client | cpe | Not reported | 3.0.10 | Not reported | Not reported | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [libasync-http-client-java]Not affected
Source package: [async-http-client]
Details (4)
2.12.3-1· all · bookwormNot affected
nvd · async-http-client · debian · bookworm
2.12.3-1· all · bookwormNot affected
nvd · async-http-client · debian · bookworm
2.12.3-1+deb12u1· all · bookworm-securityNot affected
nvd · async-http-client · debian · bookworm
2.12.3-1+deb12u1· all · bookworm-securityNot affected
nvd · async-http-client · debian · bookworm
Observed: