Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade maven-shared-utilsUpgrade maven-resolver-apiUpgrade plexus-containers-component-annotationsUpgrade apache-commons-cliUpgrade maven-resolver-utilUpgrade maven-resolver-implUpgrade atinjectUpgrade maven-wagon-httpUpgrade httpcomponents-clientUpgrade maven-resolverUpgrade guava20Upgrade maven-wagon-http-sharedUpgrade apache-commons-ioUpgrade maven-openjdk8Upgrade jansiUpgrade sisu-plexusUpgrade jansi-nativeUpgrade maven-openjdk11Upgrade glassfish-el-apiUpgrade google-guiceUpgrade maven-resolver-spiUpgrade maven-wagon-fileUpgrade plexus-classworldsUpgrade maven-openjdk17Upgrade jsr-305Upgrade plexus-interpolationUpgrade plexus-cipherUpgrade maven-libUpgrade jsoupUpgrade maven-resolver-transport-wagonUpgrade apache-commons-codecUpgrade maven-wagonUpgrade slf4jUpgrade jboss-interceptors-1.2-apiUpgrade geronimo-annotationUpgrade sisuUpgrade hawtjni-runtimeUpgrade maven-resolver-connector-basicUpgrade guavaUpgrade plexus-sec-dispatcherUpgrade aopallianceUpgrade cdi-apiUpgrade sisu-injectUpgrade mavenUpgrade plexus-utilsUpgrade jcl-over-slf4jUpgrade apache-commons-lang3Upgrade apache-commons-loggingUpgrade maven-wagon-provider-apiUpgrade httpcomponents-core | May 13, 2022 | Dec 2, 2020 |
| Amazon Linux Ami 2 | — | Upgrade httpcomponents-clientUpgrade httpcomponents-client-javadoc | Feb 23, 2023 | Dec 2, 2020 |
| Centos_linux | — | Upgrade jansi-nativeUpgrade maven-openjdk17Upgrade maven-resolver-connector-basicUpgrade plexus-sec-dispatcherUpgrade maven-wagonUpgrade httpcomponents-clientUpgrade maven-resolver-apiUpgrade jansiUpgrade plexus-containers-component-annotationsUpgrade apache-commons-codecUpgrade cdi-apiUpgrade maven-openjdk11Upgrade apache-commons-loggingUpgrade apache-commons-cliUpgrade plexus-cipherUpgrade sisuUpgrade apache-commons-ioUpgrade apache-commons-lang3Upgrade maven-wagon-fileUpgrade guava20Upgrade maven-openjdk8Upgrade sisu-plexusUpgrade slf4jUpgrade maven-resolver-transport-wagonUpgrade maven-resolver-utilUpgrade hawtjni-runtimeUpgrade maven-shared-utilsUpgrade httpcomponents-coreUpgrade maven-resolver-spiUpgrade plexus-classworldsUpgrade sisu-injectUpgrade maven-wagon-http-sharedUpgrade maven-libUpgrade jsoupUpgrade maven-wagon-provider-apiUpgrade geronimo-annotationUpgrade maven-wagon-httpUpgrade mavenUpgrade aopallianceUpgrade jcl-over-slf4jUpgrade maven-resolver-implUpgrade atinjectUpgrade plexus-utilsUpgrade jsr-305Upgrade maven-resolverUpgrade glassfish-el-apiUpgrade google-guiceUpgrade plexus-interpolationUpgrade jboss-interceptors-1.2-apiUpgrade guava | May 13, 2022 | Dec 2, 2020 |
| Debian | — | Upgrade httpcomponents-client | Oct 13, 2020 | Oct 13, 2020 |
| Freebsd | — | Upgrade httpclientUpgrade jakarta-commons-httpclientUpgrade apache-commons-httpclientUpgrade maven | Nov 4, 2022 | Apr 19, 2021 |
| Oracle Weblogic | — | Apply the Patch Set Update (PSU) 33727616 for version 12.2.1.4.0.Apply the Patch Set Update (PSU) 33727619 for version 14.1.1.0.0. | Feb 28, 2022 | Dec 2, 2020 |
| Oracle_linux | — | Upgrade maven-shared-utilsUpgrade maven-wagon-provider-apiUpgrade maven-wagon-http-sharedUpgrade slf4jUpgrade jboss-interceptors-1.2-apiUpgrade jsoupUpgrade maven-resolver-implUpgrade plexus-classworldsUpgrade apache-commons-codecUpgrade guava20Upgrade plexus-cipherUpgrade maven-openjdk17Upgrade maven-resolver-transport-wagonUpgrade aopallianceUpgrade mavenUpgrade maven-resolver-utilUpgrade guavaUpgrade maven-resolver-connector-basicUpgrade plexus-utilsUpgrade glassfish-el-apiUpgrade google-guiceUpgrade jcl-over-slf4jUpgrade cdi-apiUpgrade httpcomponents-clientUpgrade jsr-305Upgrade geronimo-annotationUpgrade apache-commons-lang3Upgrade maven-openjdk8Upgrade httpcomponents-coreUpgrade maven-wagonUpgrade maven-resolverUpgrade sisu-injectUpgrade maven-openjdk11Upgrade jansiUpgrade atinjectUpgrade plexus-containers-component-annotationsUpgrade jansi-nativeUpgrade sisu-plexusUpgrade sisuUpgrade hawtjni-runtimeUpgrade plexus-sec-dispatcherUpgrade maven-libUpgrade maven-resolver-apiUpgrade maven-wagon-httpUpgrade maven-wagon-fileUpgrade apache-commons-loggingUpgrade plexus-interpolationUpgrade apache-commons-ioUpgrade apache-commons-cliUpgrade maven-resolver-spi | May 18, 2022 | Oct 8, 2020 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Oct 8, 2020 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | Dec 2, 2020 |
| Redhat_linux | — | Upgrade guava20Upgrade maven-openjdk17Upgrade sisu-plexusUpgrade jcl-over-slf4jUpgrade hawtjni-runtimeUpgrade maven-resolver-utilUpgrade guavaUpgrade maven-resolver-transport-wagonUpgrade httpcomponents-clientUpgrade maven-resolver-implUpgrade google-guiceUpgrade cdi-apiUpgrade mavenUpgrade maven-wagon-http-sharedUpgrade jsoupUpgrade glassfish-el-apiUpgrade apache-commons-codecUpgrade maven-shared-utilsUpgrade aopallianceUpgrade plexus-classworldsUpgrade plexus-sec-dispatcherUpgrade maven-openjdk8Upgrade jsr-305Upgrade maven-resolver-spiUpgrade jansiNo solution existsUpgrade maven-resolverUpgrade httpcomponents-coreUpgrade atinjectUpgrade plexus-containers-component-annotationsUpgrade maven-openjdk11Upgrade apache-commons-ioUpgrade maven-libUpgrade plexus-interpolationUpgrade sisu-injectUpgrade apache-commons-lang3Upgrade plexus-cipherUpgrade maven-wagon-fileUpgrade sisuUpgrade maven-resolver-connector-basicUpgrade plexus-utilsUpgrade maven-wagon-provider-apiUpgrade maven-wagonUpgrade apache-commons-loggingUpgrade jansi-nativeUpgrade geronimo-annotationUpgrade apache-commons-cliUpgrade maven-wagon-httpUpgrade slf4jUpgrade maven-resolver-apiUpgrade jboss-interceptors-1.2-api | May 13, 2022 | Dec 2, 2020 |
| Rocky_linux | — | Upgrade jansi-native | Mar 5, 2024 | Dec 2, 2020 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.1.5Upgrade Splunk Enterprise to version 9.2.2Upgrade Splunk Enterprise to version 9.0.10 | Sep 30, 2025 | Dec 2, 2020 |
| Suse | — | Upgrade mavenUpgrade maven-lib | Aug 9, 2024 | Dec 2, 2020 |
| Ubuntu | — | Upgrade libhttpclient-java (Ubuntu Pro) | Mar 22, 2023 | Dec 2, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub