Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade google-guiceUpgrade maven-resolver-implUpgrade httpcomponents-clientUpgrade atinjectUpgrade maven-shared-utilsUpgrade jansi-nativeUpgrade maven-resolver-apiUpgrade apache-commons-cliUpgrade sisu-plexusUpgrade apache-commons-ioUpgrade maven-wagon-http-sharedUpgrade glassfish-el-apiUpgrade maven-resolverUpgrade guava20Upgrade plexus-containers-component-annotationsUpgrade maven-resolver-spiUpgrade maven-wagon-httpUpgrade maven-openjdk8Upgrade maven-openjdk11Upgrade maven-resolver-utilUpgrade jansiUpgrade maven-wagon-provider-apiUpgrade plexus-sec-dispatcherUpgrade plexus-utilsUpgrade plexus-classworldsUpgrade jsr-305Upgrade jsoupUpgrade maven-wagon-fileUpgrade cdi-apiUpgrade jcl-over-slf4jUpgrade maven-resolver-transport-wagonUpgrade mavenUpgrade plexus-cipherUpgrade plexus-interpolationUpgrade maven-libUpgrade sisuUpgrade apache-commons-loggingUpgrade apache-commons-codecUpgrade httpcomponents-coreUpgrade maven-wagonUpgrade maven-openjdk17Upgrade apache-commons-lang3Upgrade geronimo-annotationUpgrade sisu-injectUpgrade maven-resolver-connector-basicUpgrade jboss-interceptors-1.2-apiUpgrade hawtjni-runtimeUpgrade aopallianceUpgrade slf4jUpgrade guava | May 13, 2022 | Dec 2, 2020 |
| Amazon Linux Ami 2 | — | Upgrade httpcomponents-client-javadocUpgrade httpcomponents-client | Feb 23, 2023 | Dec 2, 2020 |
| Centos_linux | — | Upgrade apache-commons-ioUpgrade sisuUpgrade slf4jUpgrade apache-commons-loggingUpgrade jansi-nativeUpgrade hawtjni-runtimeUpgrade maven-shared-utilsUpgrade plexus-cipherUpgrade cdi-apiUpgrade maven-openjdk11Upgrade jansiUpgrade plexus-containers-component-annotationsUpgrade guava20Upgrade maven-wagon-fileUpgrade maven-resolver-transport-wagonUpgrade maven-resolver-utilUpgrade maven-wagonUpgrade maven-resolver-apiUpgrade plexus-sec-dispatcherUpgrade maven-openjdk8Upgrade sisu-plexusUpgrade apache-commons-cliUpgrade apache-commons-lang3Upgrade httpcomponents-clientUpgrade apache-commons-codecUpgrade maven-openjdk17Upgrade maven-resolver-connector-basicUpgrade maven-wagon-provider-apiUpgrade plexus-classworldsUpgrade jcl-over-slf4jUpgrade google-guiceUpgrade atinjectUpgrade jsoupUpgrade httpcomponents-coreUpgrade geronimo-annotationUpgrade sisu-injectUpgrade maven-wagon-http-sharedUpgrade maven-libUpgrade mavenUpgrade plexus-utilsUpgrade maven-resolverUpgrade jsr-305Upgrade aopallianceUpgrade maven-wagon-httpUpgrade maven-resolver-implUpgrade maven-resolver-spiUpgrade jboss-interceptors-1.2-apiUpgrade guavaUpgrade plexus-interpolationUpgrade glassfish-el-api | May 13, 2022 | Dec 2, 2020 |
| Debian | — | Upgrade httpcomponents-client | Oct 13, 2020 | Oct 13, 2020 |
| Freebsd | — | Upgrade jakarta-commons-httpclientUpgrade httpclientUpgrade apache-commons-httpclientUpgrade maven | Nov 4, 2022 | Apr 19, 2021 |
| Oracle Weblogic | — | Apply the Patch Set Update (PSU) 33727619 for version 14.1.1.0.0.Apply the Patch Set Update (PSU) 33727616 for version 12.2.1.4.0. | Feb 28, 2022 | Dec 2, 2020 |
| Oracle_linux | — | Upgrade httpcomponents-clientUpgrade guavaUpgrade maven-wagon-http-sharedUpgrade plexus-utilsUpgrade glassfish-el-apiUpgrade maven-openjdk17Upgrade cdi-apiUpgrade jcl-over-slf4jUpgrade mavenUpgrade maven-resolver-connector-basicUpgrade google-guiceUpgrade slf4jUpgrade apache-commons-codecUpgrade guava20Upgrade plexus-cipherUpgrade jboss-interceptors-1.2-apiUpgrade aopallianceUpgrade jsoupUpgrade plexus-classworldsUpgrade maven-resolver-transport-wagonUpgrade maven-resolver-utilUpgrade maven-resolver-implUpgrade maven-shared-utilsUpgrade maven-wagon-provider-apiUpgrade plexus-sec-dispatcherUpgrade sisu-injectUpgrade maven-openjdk11Upgrade jansiUpgrade maven-openjdk8Upgrade apache-commons-lang3Upgrade apache-commons-ioUpgrade jansi-nativeUpgrade maven-wagon-fileUpgrade maven-wagon-httpUpgrade maven-libUpgrade apache-commons-loggingUpgrade maven-resolver-apiUpgrade maven-resolverUpgrade plexus-interpolationUpgrade maven-wagonUpgrade httpcomponents-coreUpgrade plexus-containers-component-annotationsUpgrade atinjectUpgrade sisuUpgrade hawtjni-runtimeUpgrade maven-resolver-spiUpgrade jsr-305Upgrade geronimo-annotationUpgrade apache-commons-cliUpgrade sisu-plexus | May 18, 2022 | Oct 8, 2020 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Oct 8, 2020 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | Dec 2, 2020 |
| Redhat_linux | — | Upgrade plexus-utilsUpgrade slf4jUpgrade maven-wagonUpgrade apache-commons-cliUpgrade sisuUpgrade maven-wagon-provider-apiUpgrade maven-wagon-httpUpgrade plexus-cipherUpgrade maven-openjdk11Upgrade plexus-interpolationUpgrade apache-commons-ioUpgrade maven-wagon-fileUpgrade maven-resolver-spiUpgrade plexus-sec-dispatcherUpgrade sisu-injectUpgrade atinjectUpgrade plexus-containers-component-annotationsUpgrade apache-commons-loggingUpgrade httpcomponents-coreUpgrade jboss-interceptors-1.2-apiUpgrade maven-libUpgrade jsr-305Upgrade maven-openjdk8Upgrade apache-commons-lang3Upgrade maven-resolverUpgrade jansiUpgrade maven-resolver-connector-basicNo solution existsUpgrade geronimo-annotationUpgrade maven-resolver-apiUpgrade jansi-nativeUpgrade maven-resolver-utilUpgrade apache-commons-codecUpgrade jsoupUpgrade sisu-plexusUpgrade guavaUpgrade maven-shared-utilsUpgrade hawtjni-runtimeUpgrade maven-openjdk17Upgrade mavenUpgrade google-guiceUpgrade maven-resolver-implUpgrade httpcomponents-clientUpgrade aopallianceUpgrade guava20Upgrade maven-wagon-http-sharedUpgrade glassfish-el-apiUpgrade plexus-classworldsUpgrade maven-resolver-transport-wagonUpgrade jcl-over-slf4jUpgrade cdi-api | May 13, 2022 | Dec 2, 2020 |
| Rocky_linux | — | Upgrade jansi-native | Mar 5, 2024 | Dec 2, 2020 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.2.2Upgrade Splunk Enterprise to version 9.0.10Upgrade Splunk Enterprise to version 9.1.5 | Sep 30, 2025 | Dec 2, 2020 |
| Suse | — | Upgrade mavenUpgrade maven-lib | Aug 9, 2024 | Dec 2, 2020 |
| Ubuntu | — | Upgrade libhttpclient-java (Ubuntu Pro) | Mar 22, 2023 | Dec 2, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub