GHSA-cmxv-58fp-fm3g

Suggest an improvement
Source
https://github.com/advisories/GHSA-cmxv-58fp-fm3g
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-cmxv-58fp-fm3g/GHSA-cmxv-58fp-fm3g.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-cmxv-58fp-fm3g
Published
2026-04-14T01:07:42Z
Modified
2026-04-14T01:25:59.420286Z
Severity
  • 6.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N CVSS Calculator
Summary
AsyncHttpClient leaks authorization credentialsto untrusted domains on cross-origin redirects
Details

Impact

When redirect following is enabled (followRedirect(true)), AsyncHttpClient forwards Authorization and Proxy-Authorization headers along with Realm credentials to arbitrary redirect targets regardless of domain, scheme, or port changes. This leaks credentials on cross-domain redirects and HTTPS-to-HTTP downgrades.

Additionally, even when stripAuthorizationOnRedirect is set to true, the Realm object containing plaintext credentials is still propagated to the redirect request, causing credential re-generation for Basic and Digest authentication schemes via NettyRequestFactory.

An attacker who controls a redirect target (via open redirect, DNS rebinding, or MITM on HTTP) can capture Bearer tokens, Basic auth credentials, or any other Authorization header value.

Patches

Fixed in version 3.0.9. Users should upgrade immediately.

The fix automatically strips Authorization and Proxy-Authorization headers and clears Realm credentials whenever a redirect crosses origin boundaries (different scheme, host, or port) or downgrades from HTTPS to HTTP.

Workarounds

For users unable to upgrade, set (stripAuthorizationOnRedirect(true)) in the client config and avoid using Realm-based authentication with redirect following enabled. Note that (stripAuthorizationOnRedirect(true)) alone is insufficient on versions prior to 3.0.9 because the Realm bypass still re-generates credentials.

Alternatively, disable redirect following (followRedirect(false)) and handle redirects manually with origin validation.

Database specific 
{
    "cwe_ids": [
        "CWE-200"
    ],
    "github_reviewed_at": "2026-04-14T01:07:42Z",
    "nvd_published_at": null,
    "severity": "MODERATE",
    "github_reviewed": true
}
References

Affected packages

Maven / org.asynchttpclient:async-http-client

Package

Name
org.asynchttpclient:async-http-client
View open source insights on deps.dev
Purl
pkg:maven/org.asynchttpclient/async-http-client

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.0.9

Affected versions

2.*
2.0.0-alpha13
2.0.0-alpha14
2.0.0-alpha15
2.0.0-alpha16
2.0.0-alpha17
2.0.0-alpha18
2.0.0-alpha19
2.0.0-alpha20
2.0.0-alpha21
2.0.0-alpha22
2.0.0-alpha23
2.0.0-alpha24
2.0.0-alpha25
2.0.0-alpha26
2.0.0-alpha27
2.0.0-RC1
2.0.0-RC2
2.0.0-RC3
2.0.0-RC4
2.0.0-RC5
2.0.0-RC6
2.0.0-RC7
2.0.0-RC8
2.0.0-RC9
2.0.0-RC10
2.0.0-RC11
2.0.0-RC12
2.0.0-RC13
2.0.0-RC14
2.0.0-RC15
2.0.0-RC16
2.0.0-RC17
2.0.0-RC18
2.0.0-RC19
2.0.0-RC20
2.0.0-RC21
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.0.10
2.0.11
2.0.12
2.0.13
2.0.14
2.0.15
2.0.16
2.0.17
2.0.18
2.0.19
2.0.20
2.0.21
2.0.22
2.0.23
2.0.24
2.0.25
2.0.26
2.0.27
2.0.28
2.0.29
2.0.30
2.0.31
2.0.32
2.0.33
2.0.34
2.0.35
2.0.36
2.0.37
2.0.38
2.0.39
2.0.40
2.1.0-alpha1
2.1.0-alpha2
2.1.0-alpha3
2.1.0-alpha4
2.1.0-alpha5
2.1.0-alpha6
2.1.0-alpha7
2.1.0-alpha8
2.1.0-alpha9
2.1.0-alpha10
2.1.0-alpha11
2.1.0-alpha12
2.1.0-alpha13
2.1.0-alpha14
2.1.0-alpha15
2.1.0-alpha16
2.1.0-alpha17
2.1.0-alpha18
2.1.0-alpha19
2.1.0-alpha20
2.1.0-alpha21
2.1.0-alpha22
2.1.0-alpha23
2.1.0-alpha24
2.1.0-alpha25
2.1.0-alpha26
2.1.0-RC1
2.1.0-RC2
2.1.0-RC3
2.1.0-RC4
2.1.0
2.1.1
2.1.2
2.2.0
2.2.1
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.4.9
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.7.0
2.8.0
2.8.1
2.9.0
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.12.3
2.12.4
3.*
3.0.0.Beta1
3.0.0.Beta2
3.0.0.Beta3
3.0.0
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.0.8

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-cmxv-58fp-fm3g/GHSA-cmxv-58fp-fm3g.json"