CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-45300

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Versions on the 2.x branch prior to 2.15.0 and the 3.x branch prior to 3.0.10 leak `Cookie` headers to cross-origin redirect targets. When following a redirect to a different origin, the `propagatedHeaders()` method in `Redirect30xInterceptor.java` strips `Authorization` and `Proxy-Authorization` headers but does not strip the `Cookie` header, causing session cookies and other sensitive cookie values to be sent to attacker-controlled servers. Versions 2.15.0 and 3.0.10 patch the issue.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.0

EPSS Ranking 9.3%

CVSS Severity

CVSS v3 Score 7.4

References

Products affected by CVE-2026-45300

Asynchttpclient Project » Async-Http-Client » Version: 2.0.0

cpe:2.3:a:asynchttpclient_project:async-http-client:2.0.0
Asynchttpclient Project » Async-Http-Client » Version: 2.0.1

cpe:2.3:a:asynchttpclient_project:async-http-client:2.0.1
Asynchttpclient Project » Async-Http-Client » Version: 2.0.10

cpe:2.3:a:asynchttpclient_project:async-http-client:2.0.10
Asynchttpclient Project » Async-Http-Client » Version: 2.0.11

cpe:2.3:a:asynchttpclient_project:async-http-client:2.0.11
Asynchttpclient Project » Async-Http-Client » Version: 2.0.12

cpe:2.3:a:asynchttpclient_project:async-http-client:2.0.12
Asynchttpclient Project » Async-Http-Client » Version: 2.0.13

cpe:2.3:a:asynchttpclient_project:async-http-client:2.0.13
Asynchttpclient Project » Async-Http-Client » Version: 2.0.14

cpe:2.3:a:asynchttpclient_project:async-http-client:2.0.14
Asynchttpclient Project » Async-Http-Client » Version: 2.0.15

cpe:2.3:a:asynchttpclient_project:async-http-client:2.0.15
Asynchttpclient Project » Async-Http-Client » Version: 2.0.16

cpe:2.3:a:asynchttpclient_project:async-http-client:2.0.16
Asynchttpclient Project » Async-Http-Client » Version: 2.0.17

cpe:2.3:a:asynchttpclient_project:async-http-client:2.0.17
Asynchttpclient Project » Async-Http-Client » Version: 2.0.18

cpe:2.3:a:asynchttpclient_project:async-http-client:2.0.18
Asynchttpclient Project » Async-Http-Client » Version: 2.0.19

cpe:2.3:a:asynchttpclient_project:async-http-client:2.0.19
Asynchttpclient Project » Async-Http-Client » Version: 2.0.2

cpe:2.3:a:asynchttpclient_project:async-http-client:2.0.2
Asynchttpclient Project » Async-Http-Client » Version: 2.0.20

cpe:2.3:a:asynchttpclient_project:async-http-client:2.0.20
Asynchttpclient Project » Async-Http-Client » Version: 2.0.21

cpe:2.3:a:asynchttpclient_project:async-http-client:2.0.21
Asynchttpclient Project » Async-Http-Client » Version: 2.0.22

cpe:2.3:a:asynchttpclient_project:async-http-client:2.0.22
Asynchttpclient Project » Async-Http-Client » Version: 2.0.23

cpe:2.3:a:asynchttpclient_project:async-http-client:2.0.23
Asynchttpclient Project » Async-Http-Client » Version: 2.0.24

cpe:2.3:a:asynchttpclient_project:async-http-client:2.0.24
Asynchttpclient Project » Async-Http-Client » Version: 2.0.25

cpe:2.3:a:asynchttpclient_project:async-http-client:2.0.25
Asynchttpclient Project » Async-Http-Client » Version: 2.0.26

cpe:2.3:a:asynchttpclient_project:async-http-client:2.0.26
Asynchttpclient Project » Async-Http-Client » Version: 2.0.27

cpe:2.3:a:asynchttpclient_project:async-http-client:2.0.27
Asynchttpclient Project » Async-Http-Client » Version: 2.0.28

cpe:2.3:a:asynchttpclient_project:async-http-client:2.0.28
Asynchttpclient Project » Async-Http-Client » Version: 2.0.29

cpe:2.3:a:asynchttpclient_project:async-http-client:2.0.29
Asynchttpclient Project » Async-Http-Client » Version: 2.0.3

cpe:2.3:a:asynchttpclient_project:async-http-client:2.0.3
Asynchttpclient Project » Async-Http-Client » Version: 2.0.30

cpe:2.3:a:asynchttpclient_project:async-http-client:2.0.30
Asynchttpclient Project » Async-Http-Client » Version: 2.0.31

cpe:2.3:a:asynchttpclient_project:async-http-client:2.0.31
Asynchttpclient Project » Async-Http-Client » Version: 2.0.32

cpe:2.3:a:asynchttpclient_project:async-http-client:2.0.32
Asynchttpclient Project » Async-Http-Client » Version: 2.0.33

cpe:2.3:a:asynchttpclient_project:async-http-client:2.0.33
Asynchttpclient Project » Async-Http-Client » Version: 2.0.34

cpe:2.3:a:asynchttpclient_project:async-http-client:2.0.34
Asynchttpclient Project » Async-Http-Client » Version: 2.0.35

cpe:2.3:a:asynchttpclient_project:async-http-client:2.0.35
Asynchttpclient Project » Async-Http-Client » Version: 2.0.36

cpe:2.3:a:asynchttpclient_project:async-http-client:2.0.36
Asynchttpclient Project » Async-Http-Client » Version: 2.0.37

cpe:2.3:a:asynchttpclient_project:async-http-client:2.0.37
Asynchttpclient Project » Async-Http-Client » Version: 2.0.38

cpe:2.3:a:asynchttpclient_project:async-http-client:2.0.38
Asynchttpclient Project » Async-Http-Client » Version: 2.0.39

cpe:2.3:a:asynchttpclient_project:async-http-client:2.0.39
Asynchttpclient Project » Async-Http-Client » Version: 2.0.4

cpe:2.3:a:asynchttpclient_project:async-http-client:2.0.4
Asynchttpclient Project » Async-Http-Client » Version: 2.0.40

cpe:2.3:a:asynchttpclient_project:async-http-client:2.0.40
Asynchttpclient Project » Async-Http-Client » Version: 2.0.5

cpe:2.3:a:asynchttpclient_project:async-http-client:2.0.5
Asynchttpclient Project » Async-Http-Client » Version: 2.0.6

cpe:2.3:a:asynchttpclient_project:async-http-client:2.0.6
Asynchttpclient Project » Async-Http-Client » Version: 2.0.7

cpe:2.3:a:asynchttpclient_project:async-http-client:2.0.7
Asynchttpclient Project » Async-Http-Client » Version: 2.0.8

cpe:2.3:a:asynchttpclient_project:async-http-client:2.0.8
Asynchttpclient Project » Async-Http-Client » Version: 2.0.9

cpe:2.3:a:asynchttpclient_project:async-http-client:2.0.9
Asynchttpclient Project » Async-Http-Client » Version: 2.1.0

cpe:2.3:a:asynchttpclient_project:async-http-client:2.1.0
Asynchttpclient Project » Async-Http-Client » Version: 2.1.1

cpe:2.3:a:asynchttpclient_project:async-http-client:2.1.1
Asynchttpclient Project » Async-Http-Client » Version: 2.1.2

cpe:2.3:a:asynchttpclient_project:async-http-client:2.1.2
Asynchttpclient Project » Async-Http-Client » Version: 2.10.0

cpe:2.3:a:asynchttpclient_project:async-http-client:2.10.0
Asynchttpclient Project » Async-Http-Client » Version: 2.10.1

cpe:2.3:a:asynchttpclient_project:async-http-client:2.10.1
Asynchttpclient Project » Async-Http-Client » Version: 2.10.2

cpe:2.3:a:asynchttpclient_project:async-http-client:2.10.2
Asynchttpclient Project » Async-Http-Client » Version: 2.10.3

cpe:2.3:a:asynchttpclient_project:async-http-client:2.10.3
Asynchttpclient Project » Async-Http-Client » Version: 2.10.4

cpe:2.3:a:asynchttpclient_project:async-http-client:2.10.4
Asynchttpclient Project » Async-Http-Client » Version: 2.10.5

cpe:2.3:a:asynchttpclient_project:async-http-client:2.10.5
Asynchttpclient Project » Async-Http-Client » Version: 2.11.0

cpe:2.3:a:asynchttpclient_project:async-http-client:2.11.0
Asynchttpclient Project » Async-Http-Client » Version: 2.12.0

cpe:2.3:a:asynchttpclient_project:async-http-client:2.12.0
Asynchttpclient Project » Async-Http-Client » Version: 2.12.1

cpe:2.3:a:asynchttpclient_project:async-http-client:2.12.1
Asynchttpclient Project » Async-Http-Client » Version: 2.12.2

cpe:2.3:a:asynchttpclient_project:async-http-client:2.12.2
Asynchttpclient Project » Async-Http-Client » Version: 2.12.3

cpe:2.3:a:asynchttpclient_project:async-http-client:2.12.3
Asynchttpclient Project » Async-Http-Client » Version: 2.12.4

cpe:2.3:a:asynchttpclient_project:async-http-client:2.12.4
Asynchttpclient Project » Async-Http-Client » Version: 2.14.5

cpe:2.3:a:asynchttpclient_project:async-http-client:2.14.5
Asynchttpclient Project » Async-Http-Client » Version: 2.2.0

cpe:2.3:a:asynchttpclient_project:async-http-client:2.2.0
Asynchttpclient Project » Async-Http-Client » Version: 2.2.1

cpe:2.3:a:asynchttpclient_project:async-http-client:2.2.1
Asynchttpclient Project » Async-Http-Client » Version: 2.3.0

cpe:2.3:a:asynchttpclient_project:async-http-client:2.3.0
Asynchttpclient Project » Async-Http-Client » Version: 2.4.0

cpe:2.3:a:asynchttpclient_project:async-http-client:2.4.0
Asynchttpclient Project » Async-Http-Client » Version: 2.4.1

cpe:2.3:a:asynchttpclient_project:async-http-client:2.4.1
Asynchttpclient Project » Async-Http-Client » Version: 2.4.2

cpe:2.3:a:asynchttpclient_project:async-http-client:2.4.2
Asynchttpclient Project » Async-Http-Client » Version: 2.4.3

cpe:2.3:a:asynchttpclient_project:async-http-client:2.4.3
Asynchttpclient Project » Async-Http-Client » Version: 2.4.4

cpe:2.3:a:asynchttpclient_project:async-http-client:2.4.4
Asynchttpclient Project » Async-Http-Client » Version: 2.4.5

cpe:2.3:a:asynchttpclient_project:async-http-client:2.4.5
Asynchttpclient Project » Async-Http-Client » Version: 2.4.6

cpe:2.3:a:asynchttpclient_project:async-http-client:2.4.6
Asynchttpclient Project » Async-Http-Client » Version: 2.4.7

cpe:2.3:a:asynchttpclient_project:async-http-client:2.4.7
Asynchttpclient Project » Async-Http-Client » Version: 2.4.8

cpe:2.3:a:asynchttpclient_project:async-http-client:2.4.8
Asynchttpclient Project » Async-Http-Client » Version: 2.4.9

cpe:2.3:a:asynchttpclient_project:async-http-client:2.4.9
Asynchttpclient Project » Async-Http-Client » Version: 2.5.0

cpe:2.3:a:asynchttpclient_project:async-http-client:2.5.0
Asynchttpclient Project » Async-Http-Client » Version: 2.5.1

cpe:2.3:a:asynchttpclient_project:async-http-client:2.5.1
Asynchttpclient Project » Async-Http-Client » Version: 2.5.2

cpe:2.3:a:asynchttpclient_project:async-http-client:2.5.2
Asynchttpclient Project » Async-Http-Client » Version: 2.5.3

cpe:2.3:a:asynchttpclient_project:async-http-client:2.5.3
Asynchttpclient Project » Async-Http-Client » Version: 2.5.4

cpe:2.3:a:asynchttpclient_project:async-http-client:2.5.4
Asynchttpclient Project » Async-Http-Client » Version: 2.6.0

cpe:2.3:a:asynchttpclient_project:async-http-client:2.6.0
Asynchttpclient Project » Async-Http-Client » Version: 2.7.0

cpe:2.3:a:asynchttpclient_project:async-http-client:2.7.0
Asynchttpclient Project » Async-Http-Client » Version: 2.8.0

cpe:2.3:a:asynchttpclient_project:async-http-client:2.8.0
Asynchttpclient Project » Async-Http-Client » Version: 2.8.1

cpe:2.3:a:asynchttpclient_project:async-http-client:2.8.1
Asynchttpclient Project » Async-Http-Client » Version: 2.9.0

cpe:2.3:a:asynchttpclient_project:async-http-client:2.9.0
Asynchttpclient Project » Async-Http-Client » Version: 3.0.0

cpe:2.3:a:asynchttpclient_project:async-http-client:3.0.0
Asynchttpclient Project » Async-Http-Client » Version: 3.0.1

cpe:2.3:a:asynchttpclient_project:async-http-client:3.0.1
Asynchttpclient Project » Async-Http-Client » Version: 3.0.2

cpe:2.3:a:asynchttpclient_project:async-http-client:3.0.2
Asynchttpclient Project » Async-Http-Client » Version: 3.0.3

cpe:2.3:a:asynchttpclient_project:async-http-client:3.0.3
Asynchttpclient Project » Async-Http-Client » Version: 3.0.4

cpe:2.3:a:asynchttpclient_project:async-http-client:3.0.4
Asynchttpclient Project » Async-Http-Client » Version: 3.0.5

cpe:2.3:a:asynchttpclient_project:async-http-client:3.0.5
Asynchttpclient Project » Async-Http-Client » Version: 3.0.6

cpe:2.3:a:asynchttpclient_project:async-http-client:3.0.6
Asynchttpclient Project » Async-Http-Client » Version: 3.0.7

cpe:2.3:a:asynchttpclient_project:async-http-client:3.0.7
Asynchttpclient Project » Async-Http-Client » Version: 3.0.8

cpe:2.3:a:asynchttpclient_project:async-http-client:3.0.8
Asynchttpclient Project » Async-Http-Client » Version: 3.0.9

cpe:2.3:a:asynchttpclient_project:async-http-client:3.0.9

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-45300

Products

Pricing

Contact Us