The AsyncHttpClient (AHC) library for Java applications has a vulnerability (CVE-2026-45300) where Cookie headers are leaked to cross-origin redirect targets. Specifically, in versions before 2.15.0 (2.x branch) and 3.0.10 (3.x branch), the method propagating headers during HTTP 30x redirects strips Authorization and Proxy-Authorization headers but does not strip Cookie headers. This results in session cookies and other sensitive cookie values being sent to potentially attacker-controlled servers when following redirects to different origins. The vulnerability is addressed in versions 2.15.0 and 3.0.10.

An attacker controlling a redirect target can receive sensitive Cookie header information, including session cookies, from an AsyncHttpClient user following a cross-origin redirect. This exposure can lead to session hijacking or unauthorized access to user sessions. The vulnerability does not affect Authorization headers, which are properly stripped, and does not impact availability or integrity.

Upgrade AsyncHttpClient to version 2.15.0 or later on the 2.x branch, or version 3.0.10 or later on the 3.x branch. These versions include fixes that prevent Cookie headers from being sent to cross-origin redirect targets. No other mitigation is required as the issue is resolved in these versions.