CVE-2026-45300: async-http-client: Cookie header not stripped on cross-origin redirect

Synopsis

This is a sensitive header leak in the AsyncHttpClient (AHC) Java library. When the library follows an HTTP redirect to a different origin, it correctly strips the Authorization header but fails to strip the Cookie header, meaning session cookies and other sensitive cookie values are forwarded to the redirect target. An attacker who can influence the redirect destination (for example, via an open redirect on a trusted service) can receive those cookies and use them to impersonate the victim. A patched-image rebuild at versions 2.15.0 and 3.0.10 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the affected service over the network to trigger or influence the HTTP request and its redirect chain.

• AuthenticationNot required

  No authentication is needed; the attacker exploits the redirect behavior without holding any account credentials on the target service.

• Victim interactionRequired

  A user or application must initiate an HTTP request that the attacker can redirect to an attacker-controlled origin, making victim participation a prerequisite.

• Attack complexityDetail

  The exploit is reliable and condition-free once a redirect to an attacker-controlled origin can be arranged; no race conditions or special memory layout are required.

Blast Radius

• An attacker receives the victim's session cookies forwarded by the redirect, enabling them to replay those cookies and impersonate the victim against the originating service.
• Any other sensitive values stored in cookies (authentication tokens, CSRF tokens, user identifiers) are also disclosed to the attacker-controlled redirect target.
• Downstream services that accept those cookies as proof of identity are exposed to unauthorized access without any additional credentials.