Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade hawtjni-runtimeUpgrade maven-resolver-connector-basicUpgrade sisuUpgrade apache-commons-loggingUpgrade apache-commons-codecUpgrade maven-wagonUpgrade apache-commons-lang3Upgrade slf4jUpgrade plexus-interpolationUpgrade maven-resolver-transport-wagonUpgrade mavenUpgrade maven-wagon-fileUpgrade plexus-sec-dispatcherUpgrade maven-openjdk17Upgrade jboss-interceptors-1.2-apiUpgrade sisu-injectUpgrade aopallianceUpgrade cdi-apiUpgrade plexus-utilsUpgrade jsoupUpgrade httpcomponents-coreUpgrade plexus-cipherUpgrade geronimo-annotationUpgrade maven-libUpgrade guavaUpgrade maven-wagon-provider-apiUpgrade jsr-305Upgrade plexus-classworldsUpgrade jcl-over-slf4jUpgrade maven-resolver-utilUpgrade jansi-nativeUpgrade httpcomponents-clientUpgrade jansiUpgrade maven-openjdk8Upgrade maven-openjdk11Upgrade maven-resolver-implUpgrade sisu-plexusUpgrade maven-wagon-http-sharedUpgrade guava20Upgrade plexus-containers-component-annotationsUpgrade glassfish-el-apiUpgrade maven-shared-utilsUpgrade google-guiceUpgrade maven-wagon-httpUpgrade atinjectUpgrade maven-resolver-apiUpgrade maven-resolver-spiUpgrade maven-resolverUpgrade apache-commons-cliUpgrade apache-commons-io | May 13, 2022 | Dec 2, 2020 |
| Amazon Linux Ami 2 | — | Upgrade httpcomponents-client-javadocUpgrade httpcomponents-client | Feb 23, 2023 | Dec 2, 2020 |
| Centos_linux | — | Upgrade maven-resolver-implUpgrade plexus-utilsUpgrade plexus-classworldsUpgrade jcl-over-slf4jUpgrade maven-wagon-http-sharedUpgrade sisu-injectUpgrade maven-libUpgrade maven-resolver-spiUpgrade jboss-interceptors-1.2-apiUpgrade guavaUpgrade mavenUpgrade jsoupUpgrade jsr-305Upgrade maven-resolverUpgrade maven-wagon-provider-apiUpgrade httpcomponents-coreUpgrade glassfish-el-apiUpgrade google-guiceUpgrade plexus-interpolationUpgrade atinjectUpgrade geronimo-annotationUpgrade aopallianceUpgrade maven-wagon-httpUpgrade plexus-cipherUpgrade maven-resolver-connector-basicUpgrade sisuUpgrade maven-resolver-apiUpgrade maven-openjdk11Upgrade cdi-apiUpgrade apache-commons-loggingUpgrade apache-commons-ioUpgrade slf4jUpgrade maven-openjdk8Upgrade maven-shared-utilsUpgrade hawtjni-runtimeUpgrade apache-commons-codecUpgrade apache-commons-cliUpgrade maven-resolver-utilUpgrade maven-resolver-transport-wagonUpgrade apache-commons-lang3Upgrade maven-wagonUpgrade maven-wagon-fileUpgrade guava20Upgrade jansi-nativeUpgrade sisu-plexusUpgrade maven-openjdk17Upgrade jansiUpgrade httpcomponents-clientUpgrade plexus-sec-dispatcherUpgrade plexus-containers-component-annotations | May 13, 2022 | Dec 2, 2020 |
| Debian | — | Upgrade httpcomponents-client | Oct 13, 2020 | Oct 13, 2020 |
| Freebsd | — | Upgrade httpclientUpgrade jakarta-commons-httpclientUpgrade apache-commons-httpclientUpgrade maven | Nov 4, 2022 | Apr 19, 2021 |
| Oracle Weblogic | — | Apply the Patch Set Update (PSU) 33727616 for version 12.2.1.4.0.Apply the Patch Set Update (PSU) 33727619 for version 14.1.1.0.0. | Feb 28, 2022 | Dec 2, 2020 |
| Oracle_linux | — | Upgrade cdi-apiUpgrade slf4jUpgrade apache-commons-codecUpgrade aopallianceUpgrade maven-resolver-implUpgrade jboss-interceptors-1.2-apiUpgrade jsoupUpgrade plexus-classworldsUpgrade guava20Upgrade google-guiceUpgrade maven-resolver-transport-wagonUpgrade guavaUpgrade maven-wagon-http-sharedUpgrade maven-openjdk17Upgrade maven-resolver-utilUpgrade httpcomponents-clientUpgrade plexus-utilsUpgrade glassfish-el-apiUpgrade maven-shared-utilsUpgrade maven-resolver-connector-basicUpgrade maven-wagon-provider-apiUpgrade plexus-cipherUpgrade jcl-over-slf4jUpgrade mavenUpgrade sisuUpgrade sisu-plexusUpgrade jsr-305Upgrade hawtjni-runtimeUpgrade apache-commons-ioUpgrade maven-wagonUpgrade plexus-interpolationUpgrade httpcomponents-coreUpgrade apache-commons-lang3Upgrade maven-openjdk8Upgrade jansi-nativeUpgrade maven-libUpgrade sisu-injectUpgrade maven-openjdk11Upgrade maven-resolver-apiUpgrade maven-wagon-httpUpgrade apache-commons-loggingUpgrade jansiUpgrade maven-resolverUpgrade maven-wagon-fileUpgrade plexus-containers-component-annotationsUpgrade atinjectUpgrade plexus-sec-dispatcherUpgrade maven-resolver-spiUpgrade geronimo-annotationUpgrade apache-commons-cli | May 18, 2022 | Oct 8, 2020 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Oct 8, 2020 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | Dec 2, 2020 |
| Redhat_linux | — | Upgrade maven-resolver-apiUpgrade geronimo-annotationUpgrade plexus-interpolationUpgrade maven-openjdk8Upgrade sisu-injectUpgrade apache-commons-loggingUpgrade apache-commons-ioUpgrade jansi-nativeUpgrade jsr-305Upgrade maven-resolver-spiUpgrade jboss-interceptors-1.2-apiUpgrade plexus-sec-dispatcherNo solution existsUpgrade jansiUpgrade atinjectUpgrade plexus-containers-component-annotationsUpgrade maven-wagon-fileUpgrade apache-commons-cliUpgrade maven-libUpgrade maven-openjdk11Upgrade maven-wagonUpgrade plexus-cipherUpgrade httpcomponents-coreUpgrade apache-commons-lang3Upgrade maven-resolver-connector-basicUpgrade slf4jUpgrade maven-wagon-httpUpgrade plexus-utilsUpgrade maven-resolverUpgrade sisuUpgrade maven-wagon-provider-apiUpgrade maven-resolver-transport-wagonUpgrade aopallianceUpgrade cdi-apiUpgrade mavenUpgrade google-guiceUpgrade maven-wagon-http-sharedUpgrade maven-resolver-implUpgrade httpcomponents-clientUpgrade jsoupUpgrade jcl-over-slf4jUpgrade maven-resolver-utilUpgrade glassfish-el-apiUpgrade plexus-classworldsUpgrade guavaUpgrade apache-commons-codecUpgrade hawtjni-runtimeUpgrade maven-shared-utilsUpgrade maven-openjdk17Upgrade guava20Upgrade sisu-plexus | May 13, 2022 | Dec 2, 2020 |
| Rocky_linux | — | Upgrade jansi-native | Mar 5, 2024 | Dec 2, 2020 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.0.10Upgrade Splunk Enterprise to version 9.1.5Upgrade Splunk Enterprise to version 9.2.2 | Sep 30, 2025 | Dec 2, 2020 |
| Suse | — | Upgrade mavenUpgrade maven-lib | Aug 9, 2024 | Dec 2, 2020 |
| Ubuntu | — | Upgrade libhttpclient-java (Ubuntu Pro) | Mar 22, 2023 | Dec 2, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub