deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-rc95-pcm8-65v9
Package: io.quarkus:quarkus-vertx-http (MAVEN)
Severity: HIGH (CVSS 8.2)
CWE: CWE-287: Improper Authentication, CWE-863: Incorrect Authorization
Vulnerable versions: < 3.20.6.1
Patched in: 3.20.6.1

Summary: Quarkus has Authentication/Authorization bypasses

Details:
Quarkus version 3.32.4 is vulnerable to an authorization bypass issue (GHSL-2026-099), in which semicolons (matrix parameters) in HTTP requests can be used to bypass security constraints, potentially allowing unauthorized access to protected resources.

Unauthenticated or lower-privileged users can bypass HTTP path-based authorization policies by appending a semicolon (`;`) and arbitrary text to the request URL. The vulnerability arises from a path-normalization inconsistency: Quarkus's [security layer](https://quarkus.io/guides/security-authorize-web-endpoints-reference) performs authorization checks on the raw URL path (which preserves matrix parameters), whereas RESTEasy Reactive's routing layer strips matrix parameters before matching endpoints. This allows requests like `/api/admin;anything` to bypass policies protecting `/api/admin` while still routing to the protected endpoint.


### Impact

This issue may lead to Authentication/Authorization bypasses.

### Credits

This issue was discovered with the [GitHub Security Lab Taskflow Agent](https://github.com/GitHubSecurityLab/seclab-taskflow-agent) and manually verified by GHSL team members [@p- (Peter Stöckli)](https://github.com/p-) and [@m-y-mo (Man Yue Mo)](https://github.com/m-y-mo).
GitHub Security Advisory: GHSA-vmj7-7xmm-4349
Package: org.silverpeas.core:silverpeas-core-web (MAVEN)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 6.4-feature13197
Patched in: unpatched

Summary: Silverpeas Core has a reflected cross-site scripting vulnerability

Details:
A reflected cross-site scripting (XSS) vulnerability in the AdvancedSearch functionality of Silverpeas Core allows attackers to execute arbitrary JavaScript in the context of a user's browser via crafted input.
GitHub Security Advisory: GHSA-vmj7-7xmm-4349
Package: org.silverpeas.core:silverpeas-core-war (MAVEN)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 6.4-feature13197
Patched in: unpatched

Summary: Silverpeas Core has a reflected cross-site scripting vulnerability

Details:
A reflected cross-site scripting (XSS) vulnerability in the AdvancedSearch functionality of Silverpeas Core allows attackers to execute arbitrary JavaScript in the context of a user's browser via crafted input.
GitHub Security Advisory: GHSA-xfxp-ppx7-cqrp
Package: org.apache.camel:camel-infinispan (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: < 4.20.0
Patched in: 4.20.0

Summary: camel-infinispan Vulnerable to Deserialization of Untrusted Data

Details:
A flaw was found in camel-infinispan. This vulnerability involves unsafe deserialization in the ProtoStream remote aggregation repository. A remote attacker with low privileges could exploit this by sending specially crafted data, leading to arbitrary code execution. This allows the attacker to gain full control over the affected system, impacting its confidentiality, integrity, and availability.
GitHub Security Advisory: GHSA-h8cj-hpmg-636v
Package: com.appsmith:interfaces (MAVEN)
Severity: HIGH (CVSS 7.2)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: <= 1.98
Patched in: 1.99

Summary: appsmith has SQL Injection in FilterDataService via Unsafe DROP TABLE Execution

Details:
### Summary
A SQL injection vulnerability exists in `FilterDataServiceCE.java` where the `dropTable` method constructs a SQL `DROP TABLE` statement using string concatenation with the table name. If the table name is derived from user input, this allows for arbitrary SQL command execution.

### Details
The vulnerability is located in `app/server/appsmith-interfaces/src/main/java/com/appsmith/external/services/ce/FilterDataServiceCE.java`.

Line 627 in `dropTable` method:
```java
public void dropTable(String tableName) {
    String dropTableQuery = "DROP TABLE " + tableName + ";";
    executeDbQuery(dropTableQuery);
}
```

The `tableName` argument is concatenated directly into the SQL string without validation or escaping.

### PoC
If `dropTable` is exposed to user input (e.g., via a utility API that accepts a table name to clean up), an attacker could provide a value like:
`valid_table; DROP TABLE users; --`

The resulting query would be:
`DROP TABLE valid_table; DROP TABLE users; --;`

This would delete the intended table and then delete the `users` table (or execute any other injected SQL).

### Impact
*   **Type:** SQL Injection
*   **Impact:** Data Loss (Drop Table), potentially Data Exfiltration or Modification depending on database permissions.
*   **Who is impacted:** Appsmith server instances.
GitHub Security Advisory: GHSA-v468-qcjx-r72w
Package: org.apache.httpcomponents.client5:httpclient5 (MAVEN)
Severity: HIGH (CVSS 7.3)
CWE: CWE-304: Missing Critical Step in Authentication
Vulnerable versions: >= 5.6-alpha1, < 5.6.1
Patched in: 5.6.1

Summary: Apache HttpClient accepts SCRAM-SHA-256 authentication without proper mutual authentication verification

Details:
Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper mutual authentication verification. Users are recommended to upgrade to version 5.6.1, which fixes this issue.
GitHub Security Advisory: GHSA-4vrc-j85c-598c
Package: org.springframework.security:spring-security-config (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-284: Improper Access Control
Vulnerable versions: >= 7.0.0, <= 7.0.4
Patched in: 7.0.5

Summary: Spring Security Doesn't Correctly Include Servlet Path in Path Matching of XML Authorization Rules

Details:
Vulnerability in Spring Spring Security. If an application uses <sec:intercept-url servlet-path="/servlet-path" pattern="/endpoint/**"/> to define the servlet path for computing a path matcher, then the servlet path is not included and the related authorization rules are not exercised. This can lead to an authorization bypass. This issue affects Spring Security: from 7.0.0 through 7.0.4.
GitHub Security Advisory: GHSA-4wrg-8wpc-h923
Package: org.springframework.security:spring-security-config (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-693: Protection Mechanism Failure
Vulnerable versions: >= 7.0.0, <= 7.0.4
Patched in: 7.0.5

Summary: Spring Security Doesn't Correctly Include Servlet Path in Path Matching of HttpSecurity#securityMatchers

Details:
Vulnerability in Spring Spring Security. If an application is using securityMatchers(String) and a PathPatternRequestMatcher.Builder bean to prepend a servlet path, matching requests to that filter chain may fail and its related security components will not be exercised as intended by the application. This can lead to the authentication, authorization, and other security controls being rendered inactive on intended requests. This issue affects Spring Security: from 7.0.0 through 7.0.4.
GitHub Security Advisory: GHSA-cvc6-q2cp-2xhw
Package: org.springframework.security:spring-security-oauth2-jose (MAVEN)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 7.0.0, <= 7.0.4
Patched in: 7.0.5

Summary: Spring Security has Potential Security Misconfiguration when Using withIssuerLocation

Details:
Vulnerability in Spring Spring Security. When an application configures JWT decoding with NimbusJwtDecoder  or NimbusReactiveJwtDecoder, it must configure an OAuth2TokenValidator<Jwt> separately, for example by calling setJwtValidator. This issue affects Spring Security: from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.
GitHub Security Advisory: GHSA-cvc6-q2cp-2xhw
Package: org.springframework.security:spring-security-oauth2-jose (MAVEN)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 6.5.0, <= 6.5.9
Patched in: 6.5.10

Summary: Spring Security has Potential Security Misconfiguration when Using withIssuerLocation

Details:
Vulnerability in Spring Spring Security. When an application configures JWT decoding with NimbusJwtDecoder  or NimbusReactiveJwtDecoder, it must configure an OAuth2TokenValidator<Jwt> separately, for example by calling setJwtValidator. This issue affects Spring Security: from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.
GitHub Security Advisory: GHSA-cvc6-q2cp-2xhw
Package: org.springframework.security:spring-security-oauth2-jose (MAVEN)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 6.4.0, <= 6.4.14
Patched in: unpatched

Summary: Spring Security has Potential Security Misconfiguration when Using withIssuerLocation

Details:
Vulnerability in Spring Spring Security. When an application configures JWT decoding with NimbusJwtDecoder  or NimbusReactiveJwtDecoder, it must configure an OAuth2TokenValidator<Jwt> separately, for example by calling setJwtValidator. This issue affects Spring Security: from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.
GitHub Security Advisory: GHSA-cvc6-q2cp-2xhw
Package: org.springframework.security:spring-security-oauth2-jose (MAVEN)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 6.3.0, <= 6.3.14
Patched in: unpatched

Summary: Spring Security has Potential Security Misconfiguration when Using withIssuerLocation

Details:
Vulnerability in Spring Spring Security. When an application configures JWT decoding with NimbusJwtDecoder  or NimbusReactiveJwtDecoder, it must configure an OAuth2TokenValidator<Jwt> separately, for example by calling setJwtValidator. This issue affects Spring Security: from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.
GitHub Security Advisory: GHSA-vxf7-qj7q-83fh
Package: org.springframework.security:spring-security-core (MAVEN)
Severity: LOW (CVSS 3.7)
CWE: CWE-208: Observable Timing Discrepancy
Vulnerable versions: >= 7.0.0, <= 7.0.4
Patched in: 7.0.5

Summary: Spring Security Vulnerable to User Attribute Enumeration when Using DaoAuthenticationProvider

Details:
Vulnerability in Spring Spring Security. If an application is using the UserDetails#isEnabled, #isAccountNonExpired, or #isAccountNonLocked user attributes, to enable, expire, or lock users, then DaoAuthenticationProvider's timing attack defense can be bypassed for users who are disabled, expired, or locked. This issue affects Spring Security: from 5.7.0 through 5.7.22, from 5.8.0 through 5.8.24, from 6.3.0 through 6.3.15, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.
GitHub Security Advisory: GHSA-vxf7-qj7q-83fh
Package: org.springframework.security:spring-security-core (MAVEN)
Severity: LOW (CVSS 3.7)
CWE: CWE-208: Observable Timing Discrepancy
Vulnerable versions: >= 6.5.0, <= 6.5.9
Patched in: 6.5.10

Summary: Spring Security Vulnerable to User Attribute Enumeration when Using DaoAuthenticationProvider

Details:
Vulnerability in Spring Spring Security. If an application is using the UserDetails#isEnabled, #isAccountNonExpired, or #isAccountNonLocked user attributes, to enable, expire, or lock users, then DaoAuthenticationProvider's timing attack defense can be bypassed for users who are disabled, expired, or locked. This issue affects Spring Security: from 5.7.0 through 5.7.22, from 5.8.0 through 5.8.24, from 6.3.0 through 6.3.15, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.
GitHub Security Advisory: GHSA-vxf7-qj7q-83fh
Package: org.springframework.security:spring-security-core (MAVEN)
Severity: LOW (CVSS 3.7)
CWE: CWE-208: Observable Timing Discrepancy
Vulnerable versions: >= 6.4.0, <= 6.4.15
Patched in: unpatched

Summary: Spring Security Vulnerable to User Attribute Enumeration when Using DaoAuthenticationProvider

Details:
Vulnerability in Spring Spring Security. If an application is using the UserDetails#isEnabled, #isAccountNonExpired, or #isAccountNonLocked user attributes, to enable, expire, or lock users, then DaoAuthenticationProvider's timing attack defense can be bypassed for users who are disabled, expired, or locked. This issue affects Spring Security: from 5.7.0 through 5.7.22, from 5.8.0 through 5.8.24, from 6.3.0 through 6.3.15, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.
GitHub Security Advisory: GHSA-vxf7-qj7q-83fh
Package: org.springframework.security:spring-security-core (MAVEN)
Severity: LOW (CVSS 3.7)
CWE: CWE-208: Observable Timing Discrepancy
Vulnerable versions: >= 6.3.0, <= 6.3.15
Patched in: unpatched

Summary: Spring Security Vulnerable to User Attribute Enumeration when Using DaoAuthenticationProvider

Details:
Vulnerability in Spring Spring Security. If an application is using the UserDetails#isEnabled, #isAccountNonExpired, or #isAccountNonLocked user attributes, to enable, expire, or lock users, then DaoAuthenticationProvider's timing attack defense can be bypassed for users who are disabled, expired, or locked. This issue affects Spring Security: from 5.7.0 through 5.7.22, from 5.8.0 through 5.8.24, from 6.3.0 through 6.3.15, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.
GitHub Security Advisory: GHSA-vxf7-qj7q-83fh
Package: org.springframework.security:spring-security-core (MAVEN)
Severity: LOW (CVSS 3.7)
CWE: CWE-208: Observable Timing Discrepancy
Vulnerable versions: >= 5.8.0, <= 5.8.24
Patched in: unpatched

Summary: Spring Security Vulnerable to User Attribute Enumeration when Using DaoAuthenticationProvider

Details:
Vulnerability in Spring Spring Security. If an application is using the UserDetails#isEnabled, #isAccountNonExpired, or #isAccountNonLocked user attributes, to enable, expire, or lock users, then DaoAuthenticationProvider's timing attack defense can be bypassed for users who are disabled, expired, or locked. This issue affects Spring Security: from 5.7.0 through 5.7.22, from 5.8.0 through 5.8.24, from 6.3.0 through 6.3.15, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.
GitHub Security Advisory: GHSA-vxf7-qj7q-83fh
Package: org.springframework.security:spring-security-core (MAVEN)
Severity: LOW (CVSS 3.7)
CWE: CWE-208: Observable Timing Discrepancy
Vulnerable versions: >= 5.7.0, <= 5.7.22
Patched in: unpatched

Summary: Spring Security Vulnerable to User Attribute Enumeration when Using DaoAuthenticationProvider

Details:
Vulnerability in Spring Spring Security. If an application is using the UserDetails#isEnabled, #isAccountNonExpired, or #isAccountNonLocked user attributes, to enable, expire, or lock users, then DaoAuthenticationProvider's timing attack defense can be bypassed for users who are disabled, expired, or locked. This issue affects Spring Security: from 5.7.0 through 5.7.22, from 5.8.0 through 5.8.24, from 6.3.0 through 6.3.15, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.
GitHub Security Advisory: GHSA-2jrg-rf5x-568g
Package: org.springframework.security:spring-security-web (MAVEN)
Severity: MODERATE (CVSS 6.8)
CWE: CWE-297: Improper Validation of Certificate with Host Mismatch
Vulnerable versions: >= 7.0.0, <= 7.0.4
Patched in: 7.0.5

Summary: Spring Security Vulnerable to Unauthorized User Impersonation when Using X.509 Client Certificates

Details:
Vulnerability in Spring Spring Security. SubjectX500PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonating another user.
This issue affects Spring Security: from 7.0.0 through 7.0.4.
GitHub Security Advisory: GHSA-x2wq-9x2f-fhj7
Package: org.springframework.security:spring-security-core (MAVEN)
Severity: MODERATE (CVSS 4.8)
CWE: CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
Vulnerable versions: >= 6.4.0, <= 6.4.13
Patched in: unpatched

Summary: Spring Security Core has a TOCTOU race condition when One-Time Token login with JdbcOneTimeTokenService is configured

Details:
Vulnerability in Spring Spring Security. Applications that explicitly configure One-Time Token login with JdbcOneTimeTokenService are vulnerable to a Time-of-check Time-of-use (TOCTOU) race condition. This issue affects Spring Security: from 6.4.0 through 6.4.15, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.
GitHub Security Advisory: GHSA-x2wq-9x2f-fhj7
Package: org.springframework.security:spring-security-core (MAVEN)
Severity: MODERATE (CVSS 4.8)
CWE: CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
Vulnerable versions: >= 7.0.3, < 7.0.5
Patched in: 7.0.5

Summary: Spring Security Core has a TOCTOU race condition when One-Time Token login with JdbcOneTimeTokenService is configured

Details:
Vulnerability in Spring Spring Security. Applications that explicitly configure One-Time Token login with JdbcOneTimeTokenService are vulnerable to a Time-of-check Time-of-use (TOCTOU) race condition. This issue affects Spring Security: from 6.4.0 through 6.4.15, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.
GitHub Security Advisory: GHSA-x2wq-9x2f-fhj7
Package: org.springframework.security:spring-security-core (MAVEN)
Severity: MODERATE (CVSS 4.8)
CWE: CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
Vulnerable versions: >= 6.5.0, < 6.5.10
Patched in: 6.5.10

Summary: Spring Security Core has a TOCTOU race condition when One-Time Token login with JdbcOneTimeTokenService is configured

Details:
Vulnerability in Spring Spring Security. Applications that explicitly configure One-Time Token login with JdbcOneTimeTokenService are vulnerable to a Time-of-check Time-of-use (TOCTOU) race condition. This issue affects Spring Security: from 6.4.0 through 6.4.15, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.
GitHub Security Advisory: GHSA-p93r-85wp-75v3
Package: org.bouncycastle:bcprov-jdk18on (MAVEN)
Severity: HIGH (CVSS 0.0)
CWE: CWE-385: Covert Timing Channel
Vulnerable versions: >= 1.71, < 1.84
Patched in: 1.84

Summary: Bouncy Castle Has Covert Timing Channel Vulnerability

Details:
Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA core on all (core modules). This vulnerability is associated with program files FrodoEngine.Java. This issue affects BC-JAVA: from 1.71 before 1.84.
GitHub Security Advisory: GHSA-p93r-85wp-75v3
Package: org.bouncycastle:bcprov-jdk14 (MAVEN)
Severity: HIGH (CVSS 0.0)
CWE: CWE-385: Covert Timing Channel
Vulnerable versions: >= 1.71, < 1.84
Patched in: 1.84

Summary: Bouncy Castle Has Covert Timing Channel Vulnerability

Details:
Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA core on all (core modules). This vulnerability is associated with program files FrodoEngine.Java. This issue affects BC-JAVA: from 1.71 before 1.84.
GitHub Security Advisory: GHSA-p93r-85wp-75v3
Package: org.bouncycastle:bcprov-jdk15to18 (MAVEN)
Severity: HIGH (CVSS 0.0)
CWE: CWE-385: Covert Timing Channel
Vulnerable versions: >= 1.71, < 1.84
Patched in: 1.84

Summary: Bouncy Castle Has Covert Timing Channel Vulnerability

Details:
Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA core on all (core modules). This vulnerability is associated with program files FrodoEngine.Java. This issue affects BC-JAVA: from 1.71 before 1.84.
GitHub Security Advisory: GHSA-wf66-mphr-4c4r
Package: org.apache.kafka:kafka-clients (MAVEN)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-532: Insertion of Sensitive Information into Log File
Vulnerable versions: = 4.0.0
Patched in: 4.0.1

Summary: Apache Kafka exposes sensitive information in its DEBUG logs

Details:
Information exposure vulnerability has been identified in Apache Kafka.

The NetworkClient component will output entire requests and responses information in the DEBUG log level in the logs. By default, the log level is set to INFO level. If the DEBUG level is enabled, the sensitive information will be exposed via the requests and responses output log. The entire lists of impacted requests and responses are:


  *  AlterConfigsRequest

  *  AlterUserScramCredentialsRequest

  *  ExpireDelegationTokenRequest

  *  IncrementalAlterConfigsRequest

  *  RenewDelegationTokenRequest

  *  SaslAuthenticateRequest

  *  createDelegationTokenResponse

  *  describeDelegationTokenResponse

  *  SaslAuthenticateResponse


This issue affects Apache Kafka: from any version supported the listed API above through v3.9.1, v4.0.0. Apache advises Kafka users to upgrade to v3.9.2, v4.0.1, or later to avoid this vulnerability.
GitHub Security Advisory: GHSA-wf66-mphr-4c4r
Package: org.apache.kafka:kafka-clients (MAVEN)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-532: Insertion of Sensitive Information into Log File
Vulnerable versions: >= 0.11.0, < 3.9.2
Patched in: 3.9.2

Summary: Apache Kafka exposes sensitive information in its DEBUG logs

Details:
Information exposure vulnerability has been identified in Apache Kafka.

The NetworkClient component will output entire requests and responses information in the DEBUG log level in the logs. By default, the log level is set to INFO level. If the DEBUG level is enabled, the sensitive information will be exposed via the requests and responses output log. The entire lists of impacted requests and responses are:


  *  AlterConfigsRequest

  *  AlterUserScramCredentialsRequest

  *  ExpireDelegationTokenRequest

  *  IncrementalAlterConfigsRequest

  *  RenewDelegationTokenRequest

  *  SaslAuthenticateRequest

  *  createDelegationTokenResponse

  *  describeDelegationTokenResponse

  *  SaslAuthenticateResponse


This issue affects Apache Kafka: from any version supported the listed API above through v3.9.1, v4.0.0. Apache advises Kafka users to upgrade to v3.9.2, v4.0.1, or later to avoid this vulnerability.
GitHub Security Advisory: GHSA-cmxv-58fp-fm3g
Package: org.asynchttpclient:async-http-client (MAVEN)
Severity: MODERATE (CVSS 6.8)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: >= 2.0.0, < 2.14.5
Patched in: 2.14.5

Summary: AsyncHttpClient leaks authorization credentials to untrusted domains on cross-origin redirects

Details:
### Impact
When redirect following is enabled (followRedirect(true)), AsyncHttpClient forwards Authorization and Proxy-Authorization headers along with Realm credentials to arbitrary redirect targets regardless of domain, scheme, or port changes. This leaks credentials on cross-domain redirects and HTTPS-to-HTTP downgrades.

Additionally, even when stripAuthorizationOnRedirect is set to true, the Realm object containing plaintext credentials is still propagated to the redirect request, causing credential re-generation for Basic and Digest authentication schemes via NettyRequestFactory.

An attacker who controls a redirect target (via open redirect, DNS rebinding, or MITM on HTTP) can capture Bearer tokens, Basic auth credentials, or any other Authorization header value.

### Patches
Fixed in version 3.0.9 or 2.14.5. Users should upgrade immediately.

The fix automatically strips Authorization and Proxy-Authorization headers and clears Realm credentials whenever a redirect crosses origin boundaries (different scheme, host, or port) or downgrades from HTTPS to HTTP.

### Workarounds
For users unable to upgrade, set (stripAuthorizationOnRedirect(true)) in the client config and avoid using Realm-based authentication with redirect following enabled. Note that (stripAuthorizationOnRedirect(true)) alone is insufficient on versions prior to 3.0.9 or 2.14.5 because the Realm bypass still re-generates credentials.

Alternatively, disable redirect following (followRedirect(false)) and handle redirects manually with origin validation.

### References
 - Fix commit: https://github.com/AsyncHttpClient/async-http-client/commit/6b2fbb7f8