Cookie Header Leak in AsyncHttpClient

Executive Summary

CVE-2026-45300 is a vulnerability in the AsyncHttpClient (AHC) library where Cookie headers are not properly stripped when following cross-origin redirects.

Specifically, when the library follows a redirect to a different origin, the method responsible for propagating headers removes Authorization and Proxy-Authorization headers but fails to remove the Cookie header.

This causes session cookies and other sensitive cookie values to be sent to potentially attacker-controlled servers.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the leakage of Cookie headers during cross-origin HTTP redirects in affected AsyncHttpClient versions. Detection would involve monitoring HTTP traffic for unexpected Cookie headers being sent to different origins, especially to attacker-controlled domains.

You can detect potential exploitation by capturing and analyzing HTTP redirect traffic from Java applications using AsyncHttpClient versions prior to the patched releases. Look for HTTP requests following redirects where Cookie headers are included despite a change in origin.

Suggested commands to monitor such behavior include using network packet capture tools like tcpdump or Wireshark to filter HTTP traffic with Cookie headers sent to different domains.

• tcpdump -i <interface> -A -s 0 'tcp port 80 or tcp port 443' | grep -i 'Cookie:'
• Use Wireshark with a display filter: http.cookie and check for requests where the Host header differs from the original domain.

Additionally, reviewing application logs for HTTP redirect responses and subsequent requests that include Cookie headers to different origins can help identify the issue.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to the leakage of sensitive session cookies, CSRF tokens, and API keys to attacker-controlled redirect targets.

As a result, attackers may hijack user sessions, steal CSRF tokens, expose API keys, and violate user privacy.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in AsyncHttpClient causes sensitive session cookies, CSRF tokens, and API keys to be leaked to potentially attacker-controlled redirect targets. This leakage can lead to session hijacking, CSRF token theft, API key exposure, and privacy violations.

Such exposure of sensitive authentication and session data can result in non-compliance with data protection regulations and standards like GDPR and HIPAA, which require the protection of personal and sensitive information against unauthorized access and disclosure.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to upgrade the AsyncHttpClient library to a patched version where this vulnerability is fixed.

• Upgrade to version 2.15.0 or later if you are using the 2.x branch.
• Upgrade to version 3.0.10 or later if you are using the 3.x branch.

These versions include a fix that strips Cookie headers during cross-origin redirects, preventing sensitive cookie leakage.

Until the upgrade can be applied, consider implementing network-level controls to monitor and block suspicious cross-origin HTTP redirects that carry Cookie headers.

Review application configurations to limit or disable automatic following of redirects where possible, or implement custom redirect handling that strips sensitive headers.

Useful 0 Not Useful 0