AsyncHttpClient versions 2.x before 2.15.0 and 3.x before 3.0.10 improperly propagate Cookie headers when following HTTP redirects to different origins. While Authorization and Proxy-Authorization headers are stripped, Cookie headers are not, leading to exposure of sensitive session cookies to potentially attacker-controlled domains. This is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The issue is resolved in versions 2.15.0 and 3.0.10 where the redirect handling logic was corrected to prevent Cookie leakage.

Exploitation of this vulnerability can result in unauthorized disclosure of sensitive cookie data, including session cookies, to external domains during cross-origin HTTP redirects. This exposure could allow attackers to hijack user sessions or gain unauthorized access to user-specific data. There is no indication of impact on data integrity or availability. No known exploits in the wild have been reported.

Upgrade AsyncHttpClient to version 2.15.0 or later on the 2.x branch, or to version 3.0.10 or later on the 3.x branch. These versions include fixes that prevent Cookie headers from being sent to cross-origin redirect targets. Patch status is confirmed by the version information in the advisory. No other mitigations are specified.