DEBIAN-CVE-2026-45300

See a problem?
Please try reporting it to the source first.

Source

https://security-tracker.debian.org/tracker/CVE-2026-45300

Import Source

https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-45300.json

JSON Data

https://api.test.osv.dev/v1/vulns/DEBIAN-CVE-2026-45300

Upstream

CVE-2026-45300

Withdrawn

2026-06-30T02:00:40Z

Published

2026-06-05T20:17:31Z

Modified

2026-06-30T02:00:40Z

Severity

7.4 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N CVSS Calculator

Summary

[none]

Details

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Versions on the 2.x branch prior to 2.15.0 and the 3.x branch prior to 3.0.10 leak Cookie headers to cross-origin redirect targets. When following a redirect to a different origin, the propagatedHeaders() method in Redirect30xInterceptor.java strips Authorization and Proxy-Authorization headers but does not strip the Cookie header, causing session cookies and other sensitive cookie values to be sent to attacker-controlled servers. Versions 2.15.0 and 3.0.10 patch the issue.

References

https://security-tracker.debian.org/tracker/CVE-2026-45300

Affected packages

Debian:11 / async-http-client

Package

Name: async-http-client
Purl: pkg:deb/debian/async-http-client?arch=source&distro=bullseye

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.12.2-1

2.12.3-1

Ecosystem specific

{
    "urgency":  "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-45300.json"

Debian:12 / async-http-client