Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade glassfish-el-apiUpgrade sisu-plexusUpgrade plexus-containers-component-annotationsUpgrade maven-wagon-httpUpgrade jansi-nativeUpgrade apache-commons-ioUpgrade maven-openjdk8Upgrade httpcomponents-clientUpgrade jansiUpgrade maven-resolver-implUpgrade maven-openjdk11Upgrade maven-resolver-apiUpgrade guava20Upgrade maven-shared-utilsUpgrade maven-resolver-spiUpgrade maven-resolverUpgrade atinjectUpgrade apache-commons-cliUpgrade google-guiceUpgrade maven-resolver-utilUpgrade maven-wagon-http-sharedUpgrade plexus-cipherUpgrade sisuUpgrade geronimo-annotationUpgrade maven-openjdk17Upgrade maven-wagon-fileUpgrade plexus-classworldsUpgrade maven-wagonUpgrade hawtjni-runtimeUpgrade apache-commons-loggingUpgrade jboss-interceptors-1.2-apiUpgrade jsr-305Upgrade jsoupUpgrade maven-resolver-transport-wagonUpgrade sisu-injectUpgrade maven-libUpgrade apache-commons-codecUpgrade jcl-over-slf4jUpgrade mavenUpgrade cdi-apiUpgrade guavaUpgrade slf4jUpgrade aopallianceUpgrade plexus-interpolationUpgrade maven-resolver-connector-basicUpgrade plexus-sec-dispatcherUpgrade plexus-utilsUpgrade maven-wagon-provider-apiUpgrade httpcomponents-coreUpgrade apache-commons-lang3 | May 13, 2022 | Dec 2, 2020 |
| Amazon Linux Ami 2 | — | Upgrade httpcomponents-client-javadocUpgrade httpcomponents-client | Feb 23, 2023 | Dec 2, 2020 |
| Centos_linux | — | Upgrade sisuUpgrade jansi-nativeUpgrade plexus-cipherUpgrade apache-commons-ioUpgrade hawtjni-runtimeUpgrade apache-commons-codecUpgrade apache-commons-loggingUpgrade slf4jUpgrade jansiUpgrade maven-shared-utilsUpgrade cdi-apiUpgrade maven-resolver-apiUpgrade maven-resolver-connector-basicUpgrade maven-openjdk17Upgrade maven-wagon-fileUpgrade maven-resolver-utilUpgrade maven-wagonUpgrade httpcomponents-clientUpgrade guava20Upgrade maven-openjdk8Upgrade apache-commons-cliUpgrade apache-commons-lang3Upgrade maven-resolver-transport-wagonUpgrade sisu-plexusUpgrade maven-openjdk11Upgrade plexus-sec-dispatcherUpgrade plexus-containers-component-annotationsUpgrade google-guiceUpgrade jcl-over-slf4jUpgrade plexus-interpolationUpgrade glassfish-el-apiUpgrade atinjectUpgrade maven-wagon-httpUpgrade maven-resolver-spiUpgrade maven-resolver-implUpgrade aopallianceUpgrade mavenUpgrade plexus-classworldsUpgrade maven-wagon-http-sharedUpgrade sisu-injectUpgrade plexus-utilsUpgrade maven-libUpgrade jboss-interceptors-1.2-apiUpgrade guavaUpgrade maven-resolverUpgrade jsoupUpgrade httpcomponents-coreUpgrade maven-wagon-provider-apiUpgrade geronimo-annotationUpgrade jsr-305 | May 13, 2022 | Dec 2, 2020 |
| Debian | — | Upgrade httpcomponents-client | Oct 13, 2020 | Oct 13, 2020 |
| Freebsd | — | Upgrade apache-commons-httpclientUpgrade mavenUpgrade jakarta-commons-httpclientUpgrade httpclient | Nov 4, 2022 | Apr 19, 2021 |
| Oracle Weblogic | — | Apply the Patch Set Update (PSU) 33727616 for version 12.2.1.4.0.Apply the Patch Set Update (PSU) 33727619 for version 14.1.1.0.0. | Feb 28, 2022 | Dec 2, 2020 |
| Oracle_linux | — | Upgrade sisu-plexusUpgrade plexus-sec-dispatcherUpgrade maven-resolverUpgrade sisuUpgrade hawtjni-runtimeUpgrade maven-wagon-fileUpgrade apache-commons-loggingUpgrade maven-wagon-httpUpgrade maven-libUpgrade maven-resolver-apiUpgrade apache-commons-lang3Upgrade jansiUpgrade maven-wagonUpgrade maven-openjdk11Upgrade apache-commons-ioUpgrade sisu-injectUpgrade plexus-interpolationUpgrade httpcomponents-coreUpgrade maven-openjdk8Upgrade maven-resolver-spiUpgrade plexus-containers-component-annotationsUpgrade geronimo-annotationUpgrade jansi-nativeUpgrade jsr-305Upgrade apache-commons-cliUpgrade atinjectUpgrade slf4jUpgrade guava20Upgrade maven-resolver-transport-wagonUpgrade maven-resolver-utilUpgrade mavenUpgrade cdi-apiUpgrade maven-resolver-connector-basicUpgrade apache-commons-codecUpgrade jcl-over-slf4jUpgrade maven-wagon-http-sharedUpgrade guavaUpgrade httpcomponents-clientUpgrade glassfish-el-apiUpgrade plexus-utilsUpgrade maven-wagon-provider-apiUpgrade maven-shared-utilsUpgrade plexus-cipherUpgrade aopallianceUpgrade jsoupUpgrade jboss-interceptors-1.2-apiUpgrade maven-resolver-implUpgrade plexus-classworldsUpgrade google-guiceUpgrade maven-openjdk17 | May 18, 2022 | Oct 8, 2020 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Oct 8, 2020 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | Dec 2, 2020 |
| Redhat_linux | — | Upgrade cdi-apiUpgrade jcl-over-slf4jUpgrade aopallianceUpgrade maven-resolver-implUpgrade httpcomponents-clientUpgrade mavenUpgrade google-guiceUpgrade apache-commons-codecUpgrade jsoupUpgrade maven-resolver-transport-wagonUpgrade maven-resolver-utilUpgrade maven-openjdk17Upgrade maven-shared-utilsUpgrade guavaUpgrade maven-wagon-http-sharedUpgrade glassfish-el-apiUpgrade hawtjni-runtimeUpgrade guava20Upgrade plexus-classworldsUpgrade sisu-plexusUpgrade plexus-sec-dispatcherUpgrade apache-commons-lang3Upgrade geronimo-annotationUpgrade maven-openjdk8Upgrade maven-resolver-connector-basicUpgrade jansi-nativeUpgrade jboss-interceptors-1.2-apiUpgrade maven-resolverUpgrade maven-libUpgrade maven-openjdk11Upgrade plexus-cipherUpgrade atinjectUpgrade maven-resolver-spiUpgrade plexus-interpolationUpgrade httpcomponents-coreUpgrade plexus-containers-component-annotationsUpgrade sisu-injectUpgrade maven-wagon-provider-apiUpgrade apache-commons-ioUpgrade jansiUpgrade apache-commons-cliUpgrade plexus-utilsUpgrade maven-wagonUpgrade apache-commons-loggingUpgrade maven-wagon-httpNo solution existsUpgrade slf4jUpgrade maven-wagon-fileUpgrade jsr-305Upgrade sisuUpgrade maven-resolver-api | May 13, 2022 | Dec 2, 2020 |
| Rocky_linux | — | Upgrade jansi-native | Mar 5, 2024 | Dec 2, 2020 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.0.10Upgrade Splunk Enterprise to version 9.2.2Upgrade Splunk Enterprise to version 9.1.5 | Sep 30, 2025 | Dec 2, 2020 |
| Suse | — | Upgrade mavenUpgrade maven-lib | Aug 9, 2024 | Dec 2, 2020 |
| Ubuntu | — | Upgrade libhttpclient-java (Ubuntu Pro) | Mar 22, 2023 | Dec 2, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub