CVE-2026-45300

Katalog CVE

CVSS 7.4 · High EPSS 0,46%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada asynchttpclient project async-http-client. Skor CVSS 3.1 7.4 (High) menurut github.com.

Deskripsi (NVD)

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Versions on the 2.x branch prior to 2.15.0 and the 3.x branch prior to 3.0.10 leak `Cookie` headers to cross-origin redirect targets. When following a redirect to a different origin, the `propagatedHeaders()` method in `Redirect30xInterceptor.java` strips `Authorization` and `Proxy-Authorization` headers but does not strip the `Cookie` header, causing session cookies and other sensitive cookie values to be sent to attacker-controlled servers. Versions 2.15.0 and 3.0.10 patch the issue.

Rincian

Terbit di NVD

5 Juni 2026

Terakhir diubah

23 Juli 2026

Status NVD

Analyzed

CVSS 3.1

7.4 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

EPSS (30 hari)

0,46% peluang dieksploitasi; lebih tinggi dari 38,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-fmxf-pm6p-7xgm exploit · mitigasi · patch · advisory vendor
• https://github.com/AsyncHttpClient/async-http-client/commit/3b0e3e9e patch
• https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.10 product · release notes