CVE-2026-40490
- Source
- https://cve.org/CVERecord?id=CVE-2026-40490
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-40490.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2026-40490
- Aliases
- Downstream
- Published
- 2026-04-18T01:31:13.860Z
- Modified
- 2026-07-17T21:16:56.321100998Z
- Severity
-
- 6.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N CVSS Calculator
- Summary
- AsyncHttpClient leaks authorization credentials to untrusted domains on cross-origin redirects
- Details
-
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. When redirect following is enabled (followRedirect(true)), versions of AsyncHttpClient prior to 3.0.9 and 2.14.5 forward Authorization and Proxy-Authorization headers along with Realm credentials to arbitrary redirect targets regardless of domain, scheme, or port changes. This leaks credentials on cross-domain redirects and HTTPS-to-HTTP downgrades. Additionally, even when stripAuthorizationOnRedirect is set to true, the Realm object containing plaintext credentials is still propagated to the redirect request, causing credential re-generation for Basic and Digest authentication schemes via NettyRequestFactory. An attacker who controls a redirect target (via open redirect, DNS rebinding, or MITM on HTTP) can capture Bearer tokens, Basic auth credentials, or any other Authorization header value. The fix in versions 3.0.9 and 2.14.5 automatically strips Authorization and Proxy-Authorization headers and clears Realm credentials whenever a redirect crosses origin boundaries (different scheme, host, or port) or downgrades from HTTPS to HTTP. For users unable to upgrade, set
(stripAuthorizationOnRedirect(true))in the client config and avoid using Realm-based authentication with redirect following enabled. Note that(stripAuthorizationOnRedirect(true))alone is insufficient on versions prior to 3.0.9 and 2.14.5 because the Realm bypass still re-generates credentials. Alternatively, disable redirect following (followRedirect(false)) and handle redirects manually with origin validation. - Database specific
{ "cwe_ids": [ "CWE-200" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40490.json", "cna_assigner": "GitHub_M" }- References
-
- https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-2.14.5
- https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.9
- https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-cmxv-58fp-fm3g
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40490.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-40490
- https://github.com/AsyncHttpClient/async-http-client/commit/6b2fbb7f8
- https://github.com/AsyncHttpClient/async-http-client/commit/ae557ad35246721c09dafb2976609cd0004e78ae
Affected packages
Git / github.com/asynchttpclient/async-http-client
Affected ranges
- Type
- GIT
- Repo
- https://github.com/asynchttpclient/async-http-client
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
Affected versions
2.*
2.0.0-alpha1
2.0.0-alpha2
2.0.0-alpha3
2.0.0-alpha4
2.0.0-alpha5
2.0.0-alpha6
2.0.0-alpha7
2.0.0-alpha8
async-http-client-1.*
async-http-client-1.0.0
async-http-client-1.2.0
async-http-client-1.3.0
async-http-client-1.3.1
async-http-client-1.3.2
async-http-client-1.4.0
async-http-client-1.4.1
async-http-client-1.5.0
async-http-client-1.6.0
async-http-client-1.6.1
async-http-client-1.6.2
async-http-client-1.6.3
async-http-client-1.7.0
async-http-client-1.7.1
async-http-client-1.7.2
async-http-client-1.7.3
async-http-client-1.7.4
async-http-client-project-2.*
async-http-client-project-2.0.0
async-http-client-project-2.0.0-RC1
async-http-client-project-2.0.0-RC10
async-http-client-project-2.0.0-RC11
async-http-client-project-2.0.0-RC12
async-http-client-project-2.0.0-RC13
async-http-client-project-2.0.0-RC14
async-http-client-project-2.0.0-RC15
async-http-client-project-2.0.0-RC16
async-http-client-project-2.0.0-RC17
async-http-client-project-2.0.0-RC18
async-http-client-project-2.0.0-RC19
async-http-client-project-2.0.0-RC2
async-http-client-project-2.0.0-RC20
async-http-client-project-2.0.0-RC21
async-http-client-project-2.0.0-RC3
async-http-client-project-2.0.0-RC4
async-http-client-project-2.0.0-RC5
async-http-client-project-2.0.0-RC6
async-http-client-project-2.0.0-RC7
async-http-client-project-2.0.0-RC8
async-http-client-project-2.0.0-RC9
async-http-client-project-2.0.0-alpha10
async-http-client-project-2.0.0-alpha11
async-http-client-project-2.0.0-alpha12
async-http-client-project-2.0.0-alpha13
async-http-client-project-2.0.0-alpha14
async-http-client-project-2.0.0-alpha15
async-http-client-project-2.0.0-alpha16
async-http-client-project-2.0.0-alpha17
async-http-client-project-2.0.0-alpha18
async-http-client-project-2.0.0-alpha19
async-http-client-project-2.0.0-alpha20
async-http-client-project-2.0.0-alpha21
async-http-client-project-2.0.0-alpha22
async-http-client-project-2.0.0-alpha23
async-http-client-project-2.0.0-alpha24
async-http-client-project-2.0.0-alpha25
async-http-client-project-2.0.0-alpha26
async-http-client-project-2.0.0-alpha27
async-http-client-project-2.0.0-alpha9
async-http-client-project-2.0.1
async-http-client-project-2.0.10
async-http-client-project-2.0.11
async-http-client-project-2.0.12
async-http-client-project-2.0.13
async-http-client-project-2.0.14
async-http-client-project-2.0.15
async-http-client-project-2.0.16
async-http-client-project-2.0.17
async-http-client-project-2.0.18
async-http-client-project-2.0.19
async-http-client-project-2.0.2
async-http-client-project-2.0.20
async-http-client-project-2.0.21
async-http-client-project-2.0.22
async-http-client-project-2.0.23
async-http-client-project-2.0.24
async-http-client-project-2.0.3
async-http-client-project-2.0.4
async-http-client-project-2.0.5
async-http-client-project-2.0.6
async-http-client-project-2.0.7
async-http-client-project-2.0.8
async-http-client-project-2.0.9
async-http-client-project-2.1.0
async-http-client-project-2.1.0-RC1
async-http-client-project-2.1.0-RC2
async-http-client-project-2.1.0-RC3
async-http-client-project-2.1.0-RC4
async-http-client-project-2.1.0-alpha10
async-http-client-project-2.1.0-alpha11
async-http-client-project-2.1.0-alpha12
async-http-client-project-2.1.0-alpha13
async-http-client-project-2.1.0-alpha14
async-http-client-project-2.1.0-alpha15
async-http-client-project-2.1.0-alpha16
async-http-client-project-2.1.0-alpha17
async-http-client-project-2.1.0-alpha18
async-http-client-project-2.1.0-alpha19
async-http-client-project-2.1.0-alpha2
async-http-client-project-2.1.0-alpha20
async-http-client-project-2.1.0-alpha21
async-http-client-project-2.1.0-alpha22
async-http-client-project-2.1.0-alpha23
async-http-client-project-2.1.0-alpha24
async-http-client-project-2.1.0-alpha25
async-http-client-project-2.1.0-alpha26
async-http-client-project-2.1.0-alpha3
async-http-client-project-2.1.0-alpha4
async-http-client-project-2.1.0-alpha5
async-http-client-project-2.1.0-alpha6
async-http-client-project-2.1.0-alpha7
async-http-client-project-2.1.0-alpha8
async-http-client-project-2.1.0-alpha9
async-http-client-project-2.1.1
async-http-client-project-2.1.2
async-http-client-project-2.10.0
async-http-client-project-2.10.1
async-http-client-project-2.10.2
async-http-client-project-2.10.3
async-http-client-project-2.10.4
async-http-client-project-2.10.5
async-http-client-project-2.11.0
async-http-client-project-2.12.0
async-http-client-project-2.12.1
async-http-client-project-2.12.2
async-http-client-project-2.12.3
async-http-client-project-2.12.4
async-http-client-project-2.2.0
async-http-client-project-2.2.1
async-http-client-project-2.3.0
async-http-client-project-2.4.0
async-http-client-project-2.4.1
async-http-client-project-2.4.2
async-http-client-project-2.4.3
async-http-client-project-2.4.4
async-http-client-project-2.4.5
async-http-client-project-2.4.6
async-http-client-project-2.4.7
async-http-client-project-2.4.8
async-http-client-project-2.4.9
async-http-client-project-2.5.0
async-http-client-project-2.5.1
async-http-client-project-2.5.2
async-http-client-project-2.5.3
async-http-client-project-2.5.4
async-http-client-project-2.6.0
async-http-client-project-2.7.0
async-http-client-project-2.8.0
async-http-client-project-2.8.1
async-http-client-project-2.9.0
Database specific
vanir_signatures
[
{
"signature_type": "Function",
"target": {
"function": "addHttpsConnector",
"file": "client/src/test/java/org/asynchttpclient/test/TestUtils.java"
},
"signature_version": "v1",
"digest": {
"length": 552.0,
"function_hash": "316043925068223985037487515404739138735"
},
"source": "https://github.com/asynchttpclient/async-http-client/commit/ae557ad35246721c09dafb2976609cd0004e78ae",
"id": "CVE-2026-40490-054a998b",
"deprecated": false
},
{
"signature_type": "Line",
"target": {
"file": "client/src/test/java/org/asynchttpclient/test/TestUtils.java"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"134145347646895491187080322061231958351",
"103852134568197663663753057412476547389",
"212088391333545825750787036678478120707",
"257745540119362731442304030520749843309"
],
"threshold": 0.9
},
"source": "https://github.com/asynchttpclient/async-http-client/commit/ae557ad35246721c09dafb2976609cd0004e78ae",
"id": "CVE-2026-40490-11ffa0da",
"deprecated": false
},
{
"signature_type": "Line",
"target": {
"file": "client/src/main/java/org/asynchttpclient/AsyncHttpClientConfig.java"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"322381890345669408585476069930284031207",
"254821823683437921605070319921489975004",
"152861730297772006148448031243375860194"
],
"threshold": 0.9
},
"source": "https://github.com/asynchttpclient/async-http-client/commit/ae557ad35246721c09dafb2976609cd0004e78ae",
"id": "CVE-2026-40490-1a9d6a86",
"deprecated": false
},
{
"signature_type": "Function",
"target": {
"function": "Redirect30xInterceptor",
"file": "client/src/main/java/org/asynchttpclient/netty/handler/intercept/Redirect30xInterceptor.java"
},
"signature_version": "v1",
"digest": {
"length": 275.0,
"function_hash": "223070756512953483171593616107560648721"
},
"source": "https://github.com/asynchttpclient/async-http-client/commit/ae557ad35246721c09dafb2976609cd0004e78ae",
"id": "CVE-2026-40490-3106e112",
"deprecated": false
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 1921.0,
"function_hash": "158343205441251535181776870284825857925"
},
"source": "https://github.com/asynchttpclient/async-http-client/commit/ae557ad35246721c09dafb2976609cd0004e78ae",
"id": "CVE-2026-40490-55783aa0",
"target": {
"function": "build",
"file": "client/src/main/java/org/asynchttpclient/DefaultAsyncHttpClientConfig.java"
}
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 2678.0,
"function_hash": "208257552555640515382049198989990236834"
},
"source": "https://github.com/asynchttpclient/async-http-client/commit/ae557ad35246721c09dafb2976609cd0004e78ae",
"id": "CVE-2026-40490-6cb32b9d",
"target": {
"function": "DefaultAsyncHttpClientConfig",
"file": "client/src/main/java/org/asynchttpclient/DefaultAsyncHttpClientConfig.java"
}
},
{
"signature_type": "Function",
"target": {
"function": "onFailureTest",
"file": "client/src/test/java/org/asynchttpclient/ws/TextMessageTest.java"
},
"signature_version": "v1",
"digest": {
"length": 366.0,
"function_hash": "236772588166535393472351172380540644845"
},
"source": "https://github.com/asynchttpclient/async-http-client/commit/ae557ad35246721c09dafb2976609cd0004e78ae",
"id": "CVE-2026-40490-7fa4b6fb",
"deprecated": false
},
{
"signature_type": "Line",
"target": {
"file": "extras/rxjava/src/test/java/org/asynchttpclient/extras/rxjava/single/AsyncHttpSingleTest.java"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"177583493076240572614010562165949087521",
"66603919068321224121590657526614283407",
"238363652843185359702703431634935422455",
"309791218396249529296260345499989260071"
],
"threshold": 0.9
},
"source": "https://github.com/asynchttpclient/async-http-client/commit/ae557ad35246721c09dafb2976609cd0004e78ae",
"id": "CVE-2026-40490-92974f00",
"deprecated": false
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"309640819503744677091467533307263092629",
"288033792424930255978615524373673380630",
"54707243005342816978067388570051798228",
"128767386559689434901498845497925453744"
],
"threshold": 0.9
},
"source": "https://github.com/asynchttpclient/async-http-client/commit/ae557ad35246721c09dafb2976609cd0004e78ae",
"id": "CVE-2026-40490-99682991",
"target": {
"file": "client/src/test/java/org/asynchttpclient/request/body/InputStreamTest.java"
}
},
{
"signature_type": "Line",
"target": {
"file": "extras/rxjava/src/test/java/org/asynchttpclient/extras/rxjava/AsyncHttpObservableTest.java"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"28704684709229815937466699441205073724",
"93407001157014553712121752481687479294",
"202397977733068107668661514561524269914",
"181442198021015570447520732948414259411",
"207956416652496484624532275101339448307",
"328758674882167862503021157808328165994",
"7844766477886479016087768032819335424",
"229887559702233568664873984310355910753",
"207956416652496484624532275101339448307",
"197207925302190499513983216346119277284",
"118140435651195502689472453047572598118",
"191441820936509766362092475720682784107",
"207956416652496484624532275101339448307",
"92246814279405293331468152904453046822",
"172104728891394184312944806376043676990",
"74374706844176135289221306789317710392",
"207956416652496484624532275101339448307",
"336953684534303591997915806604981347911",
"155347961932300954172335803601495193542",
"231248368265657976079028676831050805501"
],
"threshold": 0.9
},
"source": "https://github.com/asynchttpclient/async-http-client/commit/ae557ad35246721c09dafb2976609cd0004e78ae",
"id": "CVE-2026-40490-9ed14a72",
"deprecated": false
},
{
"signature_type": "Line",
"target": {
"file": "client/src/main/java/org/asynchttpclient/DefaultAsyncHttpClientConfig.java"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"168708030931315284119633378746194519897",
"136089636416528384590263462472202039784",
"46189962875723225671976931519357561982",
"48578107365913544475838509803764751738",
"113982703582095459177037355596647524595",
"155105951570500692871757889080738558664",
"146194849309217035351062081520537842265",
"109710471982493906344478271665412743268",
"91985928600011047021334984488606393240",
"71978288215880454028330975638035742629",
"91327796957710899609003474187493636487",
"83747150714966746050722562939793058887",
"301853644335423589353550822187287491330",
"78860938170386526850312516409895156817",
"316123560288127107111811775328335817691",
"302681219582805108524554917651160484057",
"144603024423034626702074978436649157974",
"184838364417253757580027789605562640224",
"207625680980813813478056717221059554223",
"121965780145498803782730280504628271319",
"273860716232667565933143261973849959494",
"165155232725396097447245821101612222155",
"53746438367553516122149414996697164539",
"44120803678040950098114730121693199780",
"305634017354382900251491428194739833773",
"79963517199292214709317507743466265762",
"221916571797129315688488433367305199936",
"88418958033980882440077443472327106535",
"332843412915549447773539193626730997591",
"46927639611694268498504687510358069612"
],
"threshold": 0.9
},
"source": "https://github.com/asynchttpclient/async-http-client/commit/ae557ad35246721c09dafb2976609cd0004e78ae",
"id": "CVE-2026-40490-a877573b",
"deprecated": false
},
{
"signature_type": "Function",
"target": {
"function": "Builder",
"file": "client/src/main/java/org/asynchttpclient/DefaultAsyncHttpClientConfig.java"
},
"signature_version": "v1",
"digest": {
"length": 2859.0,
"function_hash": "47888257292029244133802293525419724960"
},
"source": "https://github.com/asynchttpclient/async-http-client/commit/ae557ad35246721c09dafb2976609cd0004e78ae",
"id": "CVE-2026-40490-abad0434",
"deprecated": false
},
{
"signature_type": "Function",
"target": {
"function": "exitAfterHandlingRedirect",
"file": "client/src/main/java/org/asynchttpclient/netty/handler/intercept/Redirect30xInterceptor.java"
},
"signature_version": "v1",
"digest": {
"length": 2715.0,
"function_hash": "269547580329538354572345965349915895409"
},
"source": "https://github.com/asynchttpclient/async-http-client/commit/ae557ad35246721c09dafb2976609cd0004e78ae",
"id": "CVE-2026-40490-af402627",
"deprecated": false
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"146222710489809887309365852447598401662",
"77436583521934432956360648610024428720",
"270505264269769481892279329658720136573"
],
"threshold": 0.9
},
"source": "https://github.com/asynchttpclient/async-http-client/commit/ae557ad35246721c09dafb2976609cd0004e78ae",
"id": "CVE-2026-40490-e1028c96",
"target": {
"file": "extras/typesafeconfig/src/main/java/org/asynchttpclient/extras/typesafeconfig/AsyncHttpClientTypesafeConfig.java"
}
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 353.0,
"function_hash": "307426319409649821046062701258465984969"
},
"source": "https://github.com/asynchttpclient/async-http-client/commit/ae557ad35246721c09dafb2976609cd0004e78ae",
"id": "CVE-2026-40490-e2d8b35e",
"target": {
"function": "propagatedHeaders",
"file": "client/src/main/java/org/asynchttpclient/netty/handler/intercept/Redirect30xInterceptor.java"
}
},
{
"signature_type": "Line",
"target": {
"file": "client/src/main/java/org/asynchttpclient/netty/handler/intercept/Redirect30xInterceptor.java"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"57790161105886311695500414628902007097",
"319110538384110204883491579776311855320",
"318564660043772626597692556646030345117",
"82226100404900221638045540854635029149",
"228274141867943272513126342120037999180",
"142407304552584212247917841883777898006",
"140329392393318540730876872278779627757",
"302900350266292346503263900046978191729",
"218617204489792747302968395232354945951",
"225265514470690615065575549428696369277",
"136552531917811935354319581496067855735",
"197384826917260150875229987475080017968",
"242851672814220733505367053148252957474",
"291161199167543142070476709723328327217",
"214751009309022977213397461836296076926",
"217472434840818082462285651689229107592",
"203718286027897751115766368505425986441",
"236318192262431575827888195687698961236",
"149391606979224904628445569809644514689",
"166244585314267448812893724340407293698",
"54625548049636361261381133085874145263",
"241864682386265480366337643403749876330",
"96547328199382664248825555334641494441",
"321519962990725575030458870352151825284",
"79319371259469984946598631844729163850",
"290877216573318817761574541838769318224",
"278928649639770817865570537423963665204",
"278993001409957710337172404837057359764",
"89364639733104172303077279401094521485",
"149510654929462753432957620881942016874",
"119631579872192943427675599255261642265",
"13937946110150342694735002295082822874",
"132172460127416060898162484182700602096",
"34412132135110662699425022179613654037",
"98620923478851566303321214219875836197",
"65700546749095476148025983926374377028",
"26693426587098181349732518356949870745",
"187275284631822640111897314062435025035",
"54092756368905951197168856265336807941",
"59928007530281967928784535425697466208",
"35427723000758922960004254060039804694"
],
"threshold": 0.9
},
"source": "https://github.com/asynchttpclient/async-http-client/commit/ae557ad35246721c09dafb2976609cd0004e78ae",
"id": "CVE-2026-40490-e4844b79",
"deprecated": false
},
{
"signature_type": "Line",
"target": {
"file": "client/src/test/java/org/asynchttpclient/CookieStoreTest.java"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"105202239375475572678685012467538525212",
"272810508068292506057543846882503895014",
"47061589045468282580093271312150001510",
"181581819945825486391360630682344875320",
"93335700786725798208754276328026691350",
"175063380340188155992741854447945260454",
"15853740614981435135626481476637914098",
"277870667179573264195255668612070048404",
"70087525653087877790353651618881491061",
"17119030141862500048346089311880234881",
"101440214355017906595804222502374220967",
"19516302879175411208260387667296201421"
],
"threshold": 0.9
},
"source": "https://github.com/asynchttpclient/async-http-client/commit/ae557ad35246721c09dafb2976609cd0004e78ae",
"id": "CVE-2026-40490-e9a40165",
"deprecated": false
},
{
"signature_type": "Function",
"target": {
"function": "available",
"file": "client/src/test/java/org/asynchttpclient/request/body/InputStreamTest.java"
},
"signature_version": "v1",
"digest": {
"length": 33.0,
"function_hash": "38916718166378361812820647803389099276"
},
"source": "https://github.com/asynchttpclient/async-http-client/commit/ae557ad35246721c09dafb2976609cd0004e78ae",
"id": "CVE-2026-40490-eeb88055",
"deprecated": false
},
{
"signature_type": "Function",
"target": {
"function": "testInvalidInputStream",
"file": "client/src/test/java/org/asynchttpclient/request/body/InputStreamTest.java"
},
"signature_version": "v1",
"digest": {
"length": 847.0,
"function_hash": "112182944846686111664683100905728784158"
},
"source": "https://github.com/asynchttpclient/async-http-client/commit/ae557ad35246721c09dafb2976609cd0004e78ae",
"id": "CVE-2026-40490-ef150093",
"deprecated": false
},
{
"signature_type": "Function",
"target": {
"function": "shouldCleanExpiredCookieFromUnderlyingDataStructure",
"file": "client/src/test/java/org/asynchttpclient/CookieStoreTest.java"
},
"signature_version": "v1",
"digest": {
"length": 874.0,
"function_hash": "9776341735885647690610107220984321162"
},
"source": "https://github.com/asynchttpclient/async-http-client/commit/ae557ad35246721c09dafb2976609cd0004e78ae",
"id": "CVE-2026-40490-f17af177",
"deprecated": false
},
{
"signature_type": "Line",
"target": {
"file": "client/src/test/java/org/asynchttpclient/ws/TextMessageTest.java"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"245617878373673111962008568264808431636",
"248340462185595409820549044489155455958",
"214054307944260016676487475140302325015",
"49595713037861648414575390208204090834",
"196447720162699965744091975004789339449"
],
"threshold": 0.9
},
"source": "https://github.com/asynchttpclient/async-http-client/commit/ae557ad35246721c09dafb2976609cd0004e78ae",
"id": "CVE-2026-40490-f6446e02",
"deprecated": false
}
]
source
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-40490.json"
vanir_signatures_modified
"2026-05-28T07:28:25Z"