{"id":"CVE-2026-40490","summary":"AsyncHttpClient leaks authorization credentials to untrusted domains on cross-origin redirects","details":"The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. When redirect following is enabled (followRedirect(true)), versions of AsyncHttpClient prior to 3.0.9 and 2.14.5 forward Authorization and Proxy-Authorization headers along with Realm credentials to arbitrary redirect targets regardless of domain, scheme, or port changes. This leaks credentials on cross-domain redirects and HTTPS-to-HTTP downgrades. Additionally, even when stripAuthorizationOnRedirect is set to true, the Realm object containing plaintext credentials is still propagated to the redirect request, causing credential re-generation for Basic and Digest authentication schemes via NettyRequestFactory. An attacker who controls a redirect target (via open redirect, DNS rebinding, or MITM on HTTP) can capture Bearer tokens, Basic auth credentials, or any other Authorization header value. The fix in versions 3.0.9 and 2.14.5 automatically strips Authorization and Proxy-Authorization headers and clears Realm credentials whenever a redirect crosses origin boundaries (different scheme, host, or port) or downgrades from HTTPS to HTTP. For users unable to upgrade, set `(stripAuthorizationOnRedirect(true))` in the client config and avoid using Realm-based authentication with redirect following enabled. Note that `(stripAuthorizationOnRedirect(true))` alone is insufficient on versions prior to 3.0.9 and 2.14.5 because the Realm bypass still re-generates credentials. Alternatively, disable redirect following (`followRedirect(false)`) and handle redirects manually with origin validation.","aliases":["GHSA-cmxv-58fp-fm3g"],"modified":"2026-07-17T21:16:56.321100998Z","published":"2026-04-18T01:31:13.860Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40490.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-200"]},"references":[{"type":"WEB","url":"https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-2.14.5"},{"type":"WEB","url":"https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.9"},{"type":"ADVISORY","url":"https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-cmxv-58fp-fm3g"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40490.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40490"},{"type":"FIX","url":"https://github.com/AsyncHttpClient/async-http-client/commit/6b2fbb7f8"},{"type":"FIX","url":"https://github.com/AsyncHttpClient/async-http-client/commit/ae557ad35246721c09dafb2976609cd0004e78ae"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/asynchttpclient/async-http-client","events":[{"introduced":"0"},{"fixed":"ae557ad35246721c09dafb2976609cd0004e78ae"}]}],"versions":["async-http-client-project-2.12.4","async-http-client-project-2.12.3","async-http-client-project-2.12.2","async-http-client-project-2.12.1","async-http-client-project-2.12.0","async-http-client-project-2.11.0","async-http-client-project-2.10.5","async-http-client-project-2.10.4","async-http-client-project-2.10.3","async-http-client-project-2.10.2","async-http-client-project-2.10.1","async-http-client-project-2.10.0","async-http-client-project-2.9.0","async-http-client-project-2.8.1","async-http-client-project-2.8.0","async-http-client-project-2.7.0","async-http-client-project-2.6.0","async-http-client-project-2.5.4","async-http-client-project-2.5.3","async-http-client-project-2.5.2","async-http-client-project-2.5.1","async-http-client-project-2.5.0","async-http-client-project-2.4.9","async-http-client-project-2.4.8","async-http-client-project-2.4.7","async-http-client-project-2.4.6","async-http-client-project-2.4.5","async-http-client-project-2.4.4","async-http-client-project-2.4.3","async-http-client-project-2.4.2","async-http-client-project-2.4.1","async-http-client-project-2.4.0","async-http-client-project-2.3.0","async-http-client-project-2.2.1","async-http-client-project-2.2.0","async-http-client-project-2.1.2","async-http-client-project-2.1.1","async-http-client-project-2.1.0","async-http-client-project-2.1.0-RC4","async-http-client-project-2.1.0-RC3","async-http-client-project-2.1.0-RC2","async-http-client-project-2.1.0-RC1","async-http-client-project-2.1.0-alpha26","async-http-client-project-2.1.0-alpha25","async-http-client-project-2.1.0-alpha24","async-http-client-project-2.1.0-alpha23","async-http-client-project-2.1.0-alpha22","async-http-client-project-2.1.0-alpha21","async-http-client-project-2.1.0-alpha20","async-http-client-project-2.1.0-alpha19","async-http-client-project-2.1.0-alpha18","async-http-client-project-2.1.0-alpha17","async-http-client-project-2.1.0-alpha16","async-http-client-project-2.1.0-alpha15","async-http-client-project-2.1.0-alpha14","async-http-client-project-2.1.0-alpha13","async-http-client-project-2.1.0-alpha12","async-http-client-project-2.1.0-alpha11","async-http-client-project-2.1.0-alpha10","async-http-client-project-2.1.0-alpha9","async-http-client-project-2.1.0-alpha8","async-http-client-project-2.1.0-alpha7","async-http-client-project-2.1.0-alpha6","async-http-client-project-2.1.0-alpha5","async-http-client-project-2.1.0-alpha4","async-http-client-project-2.1.0-alpha3","async-http-client-project-2.1.0-alpha2","async-http-client-project-2.0.24","async-http-client-project-2.0.23","async-http-client-project-2.0.22","async-http-client-project-2.0.21","async-http-client-project-2.0.20","async-http-client-project-2.0.19","async-http-client-project-2.0.18","async-http-client-project-2.0.17","async-http-client-project-2.0.16","async-http-client-project-2.0.15","async-http-client-project-2.0.14","async-http-client-project-2.0.13","async-http-client-project-2.0.12","async-http-client-project-2.0.11","async-http-client-project-2.0.10","async-http-client-project-2.0.9","async-http-client-project-2.0.8","async-http-client-project-2.0.7","async-http-client-project-2.0.6","async-http-client-project-2.0.5","async-http-client-project-2.0.4","async-http-client-project-2.0.3","async-http-client-project-2.0.2","async-http-client-project-2.0.1","async-http-client-project-2.0.0","async-http-client-project-2.0.0-RC21","async-http-client-project-2.0.0-RC20","async-http-client-project-2.0.0-RC19","async-http-client-project-2.0.0-RC18","async-http-client-project-2.0.0-RC17","async-http-client-project-2.0.0-RC16","async-http-client-project-2.0.0-RC15","async-http-client-project-2.0.0-RC14","async-http-client-project-2.0.0-RC13","async-http-client-project-2.0.0-RC12","async-http-client-project-2.0.0-RC11","async-http-client-project-2.0.0-RC10","async-http-client-project-2.0.0-RC9","async-http-client-project-2.0.0-RC8","async-http-client-project-2.0.0-RC7","async-http-client-project-2.0.0-RC6","async-http-client-project-2.0.0-RC5","async-http-client-project-2.0.0-RC4","async-http-client-project-2.0.0-RC3","async-http-client-project-2.0.0-RC2","async-http-client-project-2.0.0-RC1","async-http-client-project-2.0.0-alpha27","async-http-client-project-2.0.0-alpha26","async-http-client-project-2.0.0-alpha25","async-http-client-project-2.0.0-alpha24","async-http-client-project-2.0.0-alpha23","async-http-client-project-2.0.0-alpha22","async-http-client-project-2.0.0-alpha21","async-http-client-project-2.0.0-alpha20","async-http-client-project-2.0.0-alpha19","async-http-client-project-2.0.0-alpha18","async-http-client-project-2.0.0-alpha17","async-http-client-project-2.0.0-alpha16","async-http-client-project-2.0.0-alpha15","async-http-client-project-2.0.0-alpha14","async-http-client-project-2.0.0-alpha13","async-http-client-project-2.0.0-alpha12","async-http-client-project-2.0.0-alpha11","async-http-client-project-2.0.0-alpha10","async-http-client-project-2.0.0-alpha9","2.0.0-alpha8","2.0.0-alpha7","2.0.0-alpha6","2.0.0-alpha5","2.0.0-alpha4","2.0.0-alpha3","2.0.0-alpha2","2.0.0-alpha1","async-http-client-1.7.4","async-http-client-1.7.3","async-http-client-1.7.2","async-http-client-1.7.1","async-http-client-1.7.0","async-http-client-1.6.3","async-http-client-1.6.2","async-http-client-1.6.1","async-http-client-1.6.0","async-http-client-1.5.0","async-http-client-1.4.1","async-http-client-1.4.0","async-http-client-1.3.2","async-http-client-1.3.1","async-http-client-1.3.0","async-http-client-1.2.0","async-http-client-1.0.0"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-40490.json","vanir_signatures_modified":"2026-05-28T07:28:25Z","vanir_signatures":[{"deprecated":false,"digest":{"length":552,"function_hash":"316043925068223985037487515404739138735"},"id":"CVE-2026-40490-054a998b","signature_type":"Function","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/ae557ad35246721c09dafb2976609cd0004e78ae","target":{"file":"client/src/test/java/org/asynchttpclient/test/TestUtils.java","function":"addHttpsConnector"}},{"signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/ae557ad35246721c09dafb2976609cd0004e78ae","target":{"file":"client/src/test/java/org/asynchttpclient/test/TestUtils.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["134145347646895491187080322061231958351","103852134568197663663753057412476547389","212088391333545825750787036678478120707","257745540119362731442304030520749843309"]},"id":"CVE-2026-40490-11ffa0da","signature_type":"Line"},{"id":"CVE-2026-40490-1a9d6a86","signature_type":"Line","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/ae557ad35246721c09dafb2976609cd0004e78ae","target":{"file":"client/src/main/java/org/asynchttpclient/AsyncHttpClientConfig.java"},"deprecated":false,"digest":{"line_hashes":["322381890345669408585476069930284031207","254821823683437921605070319921489975004","152861730297772006148448031243375860194"],"threshold":0.9}},{"digest":{"function_hash":"223070756512953483171593616107560648721","length":275},"id":"CVE-2026-40490-3106e112","signature_type":"Function","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/ae557ad35246721c09dafb2976609cd0004e78ae","target":{"file":"client/src/main/java/org/asynchttpclient/netty/handler/intercept/Redirect30xInterceptor.java","function":"Redirect30xInterceptor"},"deprecated":false},{"digest":{"function_hash":"158343205441251535181776870284825857925","length":1921},"id":"CVE-2026-40490-55783aa0","signature_type":"Function","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/ae557ad35246721c09dafb2976609cd0004e78ae","target":{"file":"client/src/main/java/org/asynchttpclient/DefaultAsyncHttpClientConfig.java","function":"build"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/ae557ad35246721c09dafb2976609cd0004e78ae","target":{"file":"client/src/main/java/org/asynchttpclient/DefaultAsyncHttpClientConfig.java","function":"DefaultAsyncHttpClientConfig"},"deprecated":false,"digest":{"function_hash":"208257552555640515382049198989990236834","length":2678},"id":"CVE-2026-40490-6cb32b9d","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"236772588166535393472351172380540644845","length":366},"id":"CVE-2026-40490-7fa4b6fb","signature_type":"Function","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/ae557ad35246721c09dafb2976609cd0004e78ae","target":{"file":"client/src/test/java/org/asynchttpclient/ws/TextMessageTest.java","function":"onFailureTest"}},{"deprecated":false,"digest":{"line_hashes":["177583493076240572614010562165949087521","66603919068321224121590657526614283407","238363652843185359702703431634935422455","309791218396249529296260345499989260071"],"threshold":0.9},"id":"CVE-2026-40490-92974f00","signature_type":"Line","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/ae557ad35246721c09dafb2976609cd0004e78ae","target":{"file":"extras/rxjava/src/test/java/org/asynchttpclient/extras/rxjava/single/AsyncHttpSingleTest.java"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/ae557ad35246721c09dafb2976609cd0004e78ae","target":{"file":"client/src/test/java/org/asynchttpclient/request/body/InputStreamTest.java"},"deprecated":false,"digest":{"line_hashes":["309640819503744677091467533307263092629","288033792424930255978615524373673380630","54707243005342816978067388570051798228","128767386559689434901498845497925453744"],"threshold":0.9},"id":"CVE-2026-40490-99682991"},{"signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/ae557ad35246721c09dafb2976609cd0004e78ae","target":{"file":"extras/rxjava/src/test/java/org/asynchttpclient/extras/rxjava/AsyncHttpObservableTest.java"},"deprecated":false,"digest":{"line_hashes":["28704684709229815937466699441205073724","93407001157014553712121752481687479294","202397977733068107668661514561524269914","181442198021015570447520732948414259411","207956416652496484624532275101339448307","328758674882167862503021157808328165994","7844766477886479016087768032819335424","229887559702233568664873984310355910753","207956416652496484624532275101339448307","197207925302190499513983216346119277284","118140435651195502689472453047572598118","191441820936509766362092475720682784107","207956416652496484624532275101339448307","92246814279405293331468152904453046822","172104728891394184312944806376043676990","74374706844176135289221306789317710392","207956416652496484624532275101339448307","336953684534303591997915806604981347911","155347961932300954172335803601495193542","231248368265657976079028676831050805501"],"threshold":0.9},"id":"CVE-2026-40490-9ed14a72","signature_type":"Line"},{"source":"https://github.com/asynchttpclient/async-http-client/commit/ae557ad35246721c09dafb2976609cd0004e78ae","target":{"file":"client/src/main/java/org/asynchttpclient/DefaultAsyncHttpClientConfig.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["168708030931315284119633378746194519897","136089636416528384590263462472202039784","46189962875723225671976931519357561982","48578107365913544475838509803764751738","113982703582095459177037355596647524595","155105951570500692871757889080738558664","146194849309217035351062081520537842265","109710471982493906344478271665412743268","91985928600011047021334984488606393240","71978288215880454028330975638035742629","91327796957710899609003474187493636487","83747150714966746050722562939793058887","301853644335423589353550822187287491330","78860938170386526850312516409895156817","316123560288127107111811775328335817691","302681219582805108524554917651160484057","144603024423034626702074978436649157974","184838364417253757580027789605562640224","207625680980813813478056717221059554223","121965780145498803782730280504628271319","273860716232667565933143261973849959494","165155232725396097447245821101612222155","53746438367553516122149414996697164539","44120803678040950098114730121693199780","305634017354382900251491428194739833773","79963517199292214709317507743466265762","221916571797129315688488433367305199936","88418958033980882440077443472327106535","332843412915549447773539193626730997591","46927639611694268498504687510358069612"]},"id":"CVE-2026-40490-a877573b","signature_type":"Line","signature_version":"v1"},{"source":"https://github.com/asynchttpclient/async-http-client/commit/ae557ad35246721c09dafb2976609cd0004e78ae","target":{"function":"Builder","file":"client/src/main/java/org/asynchttpclient/DefaultAsyncHttpClientConfig.java"},"deprecated":false,"digest":{"function_hash":"47888257292029244133802293525419724960","length":2859},"id":"CVE-2026-40490-abad0434","signature_type":"Function","signature_version":"v1"},{"digest":{"function_hash":"269547580329538354572345965349915895409","length":2715},"id":"CVE-2026-40490-af402627","signature_type":"Function","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/ae557ad35246721c09dafb2976609cd0004e78ae","target":{"file":"client/src/main/java/org/asynchttpclient/netty/handler/intercept/Redirect30xInterceptor.java","function":"exitAfterHandlingRedirect"},"deprecated":false},{"source":"https://github.com/asynchttpclient/async-http-client/commit/ae557ad35246721c09dafb2976609cd0004e78ae","target":{"file":"extras/typesafeconfig/src/main/java/org/asynchttpclient/extras/typesafeconfig/AsyncHttpClientTypesafeConfig.java"},"deprecated":false,"digest":{"line_hashes":["146222710489809887309365852447598401662","77436583521934432956360648610024428720","270505264269769481892279329658720136573"],"threshold":0.9},"id":"CVE-2026-40490-e1028c96","signature_type":"Line","signature_version":"v1"},{"digest":{"function_hash":"307426319409649821046062701258465984969","length":353},"id":"CVE-2026-40490-e2d8b35e","signature_type":"Function","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/ae557ad35246721c09dafb2976609cd0004e78ae","target":{"file":"client/src/main/java/org/asynchttpclient/netty/handler/intercept/Redirect30xInterceptor.java","function":"propagatedHeaders"},"deprecated":false},{"source":"https://github.com/asynchttpclient/async-http-client/commit/ae557ad35246721c09dafb2976609cd0004e78ae","target":{"file":"client/src/main/java/org/asynchttpclient/netty/handler/intercept/Redirect30xInterceptor.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["57790161105886311695500414628902007097","319110538384110204883491579776311855320","318564660043772626597692556646030345117","82226100404900221638045540854635029149","228274141867943272513126342120037999180","142407304552584212247917841883777898006","140329392393318540730876872278779627757","302900350266292346503263900046978191729","218617204489792747302968395232354945951","225265514470690615065575549428696369277","136552531917811935354319581496067855735","197384826917260150875229987475080017968","242851672814220733505367053148252957474","291161199167543142070476709723328327217","214751009309022977213397461836296076926","217472434840818082462285651689229107592","203718286027897751115766368505425986441","236318192262431575827888195687698961236","149391606979224904628445569809644514689","166244585314267448812893724340407293698","54625548049636361261381133085874145263","241864682386265480366337643403749876330","96547328199382664248825555334641494441","321519962990725575030458870352151825284","79319371259469984946598631844729163850","290877216573318817761574541838769318224","278928649639770817865570537423963665204","278993001409957710337172404837057359764","89364639733104172303077279401094521485","149510654929462753432957620881942016874","119631579872192943427675599255261642265","13937946110150342694735002295082822874","132172460127416060898162484182700602096","34412132135110662699425022179613654037","98620923478851566303321214219875836197","65700546749095476148025983926374377028","26693426587098181349732518356949870745","187275284631822640111897314062435025035","54092756368905951197168856265336807941","59928007530281967928784535425697466208","35427723000758922960004254060039804694"]},"id":"CVE-2026-40490-e4844b79","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2026-40490-e9a40165","signature_type":"Line","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/ae557ad35246721c09dafb2976609cd0004e78ae","target":{"file":"client/src/test/java/org/asynchttpclient/CookieStoreTest.java"},"deprecated":false,"digest":{"line_hashes":["105202239375475572678685012467538525212","272810508068292506057543846882503895014","47061589045468282580093271312150001510","181581819945825486391360630682344875320","93335700786725798208754276328026691350","175063380340188155992741854447945260454","15853740614981435135626481476637914098","277870667179573264195255668612070048404","70087525653087877790353651618881491061","17119030141862500048346089311880234881","101440214355017906595804222502374220967","19516302879175411208260387667296201421"],"threshold":0.9}},{"deprecated":false,"digest":{"function_hash":"38916718166378361812820647803389099276","length":33},"id":"CVE-2026-40490-eeb88055","signature_type":"Function","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/ae557ad35246721c09dafb2976609cd0004e78ae","target":{"file":"client/src/test/java/org/asynchttpclient/request/body/InputStreamTest.java","function":"available"}},{"digest":{"length":847,"function_hash":"112182944846686111664683100905728784158"},"id":"CVE-2026-40490-ef150093","signature_type":"Function","signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/ae557ad35246721c09dafb2976609cd0004e78ae","target":{"file":"client/src/test/java/org/asynchttpclient/request/body/InputStreamTest.java","function":"testInvalidInputStream"},"deprecated":false},{"source":"https://github.com/asynchttpclient/async-http-client/commit/ae557ad35246721c09dafb2976609cd0004e78ae","target":{"file":"client/src/test/java/org/asynchttpclient/CookieStoreTest.java","function":"shouldCleanExpiredCookieFromUnderlyingDataStructure"},"deprecated":false,"digest":{"function_hash":"9776341735885647690610107220984321162","length":874},"id":"CVE-2026-40490-f17af177","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/asynchttpclient/async-http-client/commit/ae557ad35246721c09dafb2976609cd0004e78ae","target":{"file":"client/src/test/java/org/asynchttpclient/ws/TextMessageTest.java"},"deprecated":false,"digest":{"line_hashes":["245617878373673111962008568264808431636","248340462185595409820549044489155455958","214054307944260016676487475140302325015","49595713037861648414575390208204090834","196447720162699965744091975004789339449"],"threshold":0.9},"id":"CVE-2026-40490-f6446e02","signature_type":"Line"}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N"}]}