CVE-2026-45300

Name	CVE-2026-45300
Description	The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Versions on the 2.x branch prior to 2.15.0 and the 3.x branch prior to 3.0.10 leak `Cookie` headers to cross-origin redirect targets. When following a redirect to a different origin, the `propagatedHeaders()` method in `Redirect30xInterceptor.java` strips `Authorization` and `Proxy-Authorization` headers but does not strip the `Cookie` header, causing session cookies and other sensitive cookie values to be sent to attacker-controlled servers. Versions 2.15.0 and 3.0.10 patch the issue.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
async-http-client (PTS)	bullseye	2.12.2-1	vulnerable
	sid, bookworm	2.12.3-1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
async-http-client	source	(unstable)	(unfixed)

Notes

https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-fmxf-pm6p-7xgm
Fixed by: https://github.com/AsyncHttpClient/async-http-client/commit/3b0e3e9e889f950c94665c7b72e1af94f922bfe2 (async-http-client-project-3.0.10)
Fixed by: https://github.com/AsyncHttpClient/async-http-client/commit/5eed33962a412a0100f8117dca849930652bfe30 (async-http-client-project-2.15.0)