Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.asynchttpclient:async-http-client | maven | >= 3.0.0.Beta1, < 3.0.10 | 3.0.10 |
| org.asynchttpclient:async-http-client | maven | >= 2.0.0, < 2.15.0 | 2.15.0 |
Miggo AIRoot Cause AnalysisThe vulnerability exists in the async-http-client library's handling of HTTP redirects. Specifically, when the client follows a redirect to a different origin (a cross-origin redirect), it is supposed to strip sensitive headers to prevent leaking credentials to a potentially untrusted third party. The code correctly stripped the Authorization and Proxy-Authorization headers but failed to strip the Cookie header.
The analysis of the patch 3b0e3e9e confirms this. The change is located in client/src/main/java/org/asynchttpclient/netty/handler/intercept/Redirect30xInterceptor.java. The core of the vulnerability is within the propagatedHeaders method. Before the fix, the logic to strip headers on a security boundary crossing (stripAuthorization being true) did not include the Cookie header.
The patch adds remove(COOKIE) to the block that executes when stripAuthorization is true, thus fixing the information leak. The exitAfterHandlingRedirect function is also identified as a relevant runtime indicator because it contains the logic that determines when to set stripAuth to true and subsequently calls propagatedHeaders. Therefore, any runtime profile of an exploit would show exitAfterHandlingRedirect calling propagatedHeaders where the cookie leakage occurs.
org.asynchttpclient.netty.handler.intercept.Redirect30xInterceptor.propagatedHeadersclient/src/main/java/org/asynchttpclient/netty/handler/intercept/Redirect30xInterceptor.java
org.asynchttpclient.netty.handler.intercept.Redirect30xInterceptor.exitAfterHandlingRedirectclient/src/main/java/org/asynchttpclient/netty/handler/intercept/Redirect30xInterceptor.java