The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Versions on the 2.x branch prior to 2.15.0 and the 3.x branch prior to 3.0.10 leak `Cookie` headers to cross-origin redirect targets. When following a redirect to a different origin, the `propagatedHeaders()` method in `Redirect30xInterceptor.java` strips `Authorization` and `Proxy-Authorization` headers but does not strip the `Cookie` header, causing session cookies and other sensitive cookie values to be sent to attacker-controlled servers. Versions 2.15.0 and 3.0.10 patch the issue.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and
    asynchronously process HTTP responses. Versions on the 2.x branch prior to 2.15.0 and the 3.x branch prior
    to 3.0.10 leak `Cookie` headers to cross-origin redirect targets. When following a redirect to a different
    origin, the `propagatedHeaders()` method in `Redirect30xInterceptor.java` strips `Authorization` and
    `Proxy-Authorization` headers but does not strip the `Cookie` header, causing session cookies and other
    sensitive cookie values to be sent to attacker-controlled servers. Versions 2.15.0 and 3.0.10 patch the
    issue. (CVE-2026-45300)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and     asynchronously process HTTP responses. Versions on the 2.x branch prior to 2.15.0 and the 3.x branch prior     to 3.0.10 leak `Cookie` headers to cross-origin redirect targets. When following a redirect to a different     origin, the `propagatedHeaders()` method in `Redirect30xInterceptor.java` strips `Authorization` and     `Proxy-Authorization` headers but does not strip the `Cookie` header, causing session cookies and other     sensitive cookie values to be sent to attacker-controlled servers. Versions 2.15.0 and 3.0.10 patch the     issue. (CVE-2026-45300)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
464068	Echo: async-http-client, org.asynchttpclient:async-http-client: security update to 2.15.0	Tenable Cloud Security	Echo Local Security Checks	Local	high
464068	Echo: async-http-client, org.asynchttpclient:async-http-client: security update to 2.15.0	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
319606	Linux Distros Unpatched Vulnerability : CVE-2026-45300	Nessus	Misc.	Local	high
442064	SCA: security update for org.asynchttpclient:async-http-client (GHSA-fmxf-pm6p-7xgm)	Tenable Cloud Security	SCA Checks	Local	high
442064	SCA: security update for org.asynchttpclient:async-http-client (GHSA-fmxf-pm6p-7xgm)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-45300

high

Tenable Plugins

high

high

high

high

high