Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Versions on the 2.x branch prior to 2.15.0 and the 3.x branch prior to 3.0.10 leak `Cookie` headers to cross-origin redirect targets. When following a redirect to a different origin, the `propagatedHeaders()` method in `Redirect30xInterceptor.java` strips `Authorization` and `Proxy-Authorization` headers but does not strip the `Cookie` header, causing session cookies and other sensitive cookie values to be sent to attacker-controlled servers. Versions 2.15.0 and 3.0.10 patch the issue.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-05-18 | 1 | Disclosure1 |
| 2026-06-06 | 2 | Disclosure1General1 |
| 2026-07-30 | 1 | Patch1 |
🚨 HIGH SEVERITY: CVE-2026-45300 (CVSS 7.4) AsyncHttpClient (AHC) library leaks Cookie headers to cross-origin redirects, exposing session tokens to attacker-controlled servers. Affected: v2.x <2.15.0, v3.x <3.0.10 ✅ Patch now! #CVE #Vulnerability #PatchNow https://t.co/WQUj78TK8G
Post summary
The tweet announces a high‑severity CVE involving AsyncHttpClient leaking Cookie headers; affected versions are listed and a patch is available.
CVE-2026-45300 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Versions on the 2.x branch prior… https://www.cve.org/CVERecord?id=CVE-2026-45300
Post summary
A brief CVE mention with no additional technical or exploit details provided.
CVE-2026-45300 Cookie Header Leakage to Cross-Origin Redirect Targets in AsyncHttpClient https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-45300
Post summary
The text announces CVE‑2026‑45300, highlighting that AsyncHttpClient leaks cookie headers to cross‑origin redirect targets.
🟠 async-http-client, Information Disclosure, #CVE-2026-45300 (Medium) https://dailycve.com/async-http-client-information-disclosure-cve-2026-45300-medium/
Post summary
The article announces a medium‑severity Information Disclosure vulnerability (CVE-2026-45300) in async-http-client; however, it provides no PoC, exploit details, or mitigation guidance.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | asynchttpclient_project | async-http-client | - | - | - |