Exposure of Sensitive System Information to an Unauthorized Control Sphere Affecting org.asynchttpclient:async-http-client package, versions [,2.15.0)[3.0.0.Beta1,3.0.10)
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JAVA-ORGASYNCHTTPCLIENT-16755239
- published19 May 2026
- disclosed18 May 2026
- creditByunSuyoung
Introduced: 18 May 2026
NewCVE-2026-45300 (opens in a new tab)How to fix?
Upgrade org.asynchttpclient:async-http-client to version 2.15.0, 3.0.10 or higher.
Overview
org.asynchttpclient:async-http-client is a maven plugin for the Async Http Client (AHC) classes.
Affected versions of this package are vulnerable to Exposure of Sensitive System Information to an Unauthorized Control Sphere via the propagatedHeaders() method during cross-origin redirects, where Cookie headers are not stripped when forwarding requests to a new origin. An attacker can obtain sensitive session cookies, CSRF tokens, or API keys by leveraging an open redirect, a compromised CDN or API gateway, or a man-in-the-middle attack on a plaintext hop in the redirect chain.