The AsyncHttpClient library does not strip the Cookie header when following a redirect to a different origin, causing application‑generated session cookies to be sent to attacker‑controlled targets. The likely attack vector is an application that performs a cross‑origin redirect, which results in accidental transmission of cookie data. This exposure of session or other sensitive cookies can allow an attacker to hijack sessions or gain unauthorized access to restricted resources—an information‑exposure weakness identified as CWE‑200.

The vulnerability affects the AsyncHttpClient:async‑http‑client library. All releases on the 2.x branch earlier than 2.15.0 and on the 3.x branch earlier than 3.0.10 are impacted. Versions 2.15.0, 3.0.10, and any later releases include the fix.

The CVSS score is 7.4, indicating high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, implying no publicly documented exploits to date. Exploitation requires that an application constructs a redirect to a different origin, which means the attacker must influence the redirect chain or the application must allow cross‑domain redirects. In such conditions, an attacker could transmit sensitive cookie data to a malicious server and potentially hijack user sessions.