Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade jsoupUpgrade guavaUpgrade plexus-cipherUpgrade jsr-305Upgrade plexus-classworldsUpgrade mavenUpgrade maven-resolver-transport-wagonUpgrade plexus-interpolationUpgrade maven-libUpgrade maven-openjdk17Upgrade maven-resolver-connector-basicUpgrade hawtjni-runtimeUpgrade apache-commons-codecUpgrade plexus-sec-dispatcherUpgrade cdi-apiUpgrade maven-wagonUpgrade geronimo-annotationUpgrade httpcomponents-coreUpgrade jcl-over-slf4jUpgrade sisuUpgrade aopallianceUpgrade maven-wagon-fileUpgrade apache-commons-loggingUpgrade sisu-injectUpgrade jboss-interceptors-1.2-apiUpgrade plexus-utilsUpgrade maven-wagon-provider-apiUpgrade apache-commons-lang3Upgrade slf4jUpgrade maven-wagon-httpUpgrade maven-shared-utilsUpgrade maven-resolver-implUpgrade maven-wagon-http-sharedUpgrade guava20Upgrade maven-resolverUpgrade glassfish-el-apiUpgrade maven-resolver-spiUpgrade apache-commons-cliUpgrade sisu-plexusUpgrade google-guiceUpgrade maven-openjdk8Upgrade maven-resolver-utilUpgrade atinjectUpgrade jansi-nativeUpgrade httpcomponents-clientUpgrade apache-commons-ioUpgrade maven-resolver-apiUpgrade jansiUpgrade plexus-containers-component-annotationsUpgrade maven-openjdk11 | May 13, 2022 | Dec 2, 2020 |
| Amazon Linux Ami 2 | — | Upgrade httpcomponents-clientUpgrade httpcomponents-client-javadoc | Feb 23, 2023 | Dec 2, 2020 |
| Centos_linux | — | Upgrade maven-resolver-spiUpgrade maven-resolver-implUpgrade maven-wagon-httpUpgrade plexus-classworldsUpgrade glassfish-el-apiUpgrade plexus-interpolationUpgrade mavenUpgrade plexus-utilsUpgrade maven-libUpgrade sisu-injectUpgrade atinjectUpgrade aopallianceUpgrade jsoupUpgrade guavaUpgrade httpcomponents-coreUpgrade jboss-interceptors-1.2-apiUpgrade jcl-over-slf4jUpgrade jsr-305Upgrade maven-resolverUpgrade geronimo-annotationUpgrade maven-wagon-provider-apiUpgrade maven-wagon-http-sharedUpgrade google-guiceUpgrade maven-shared-utilsUpgrade plexus-cipherUpgrade hawtjni-runtimeUpgrade apache-commons-codecUpgrade maven-wagon-fileUpgrade guava20Upgrade sisu-plexusUpgrade plexus-sec-dispatcherUpgrade plexus-containers-component-annotationsUpgrade apache-commons-loggingUpgrade apache-commons-cliUpgrade maven-resolver-utilUpgrade maven-resolver-transport-wagonUpgrade jansi-nativeUpgrade maven-resolver-apiUpgrade maven-resolver-connector-basicUpgrade maven-openjdk17Upgrade jansiUpgrade maven-openjdk11Upgrade cdi-apiUpgrade maven-openjdk8Upgrade maven-wagonUpgrade httpcomponents-clientUpgrade sisuUpgrade apache-commons-lang3Upgrade apache-commons-ioUpgrade slf4j | May 13, 2022 | Dec 2, 2020 |
| Debian | — | Upgrade httpcomponents-client | Oct 13, 2020 | Oct 13, 2020 |
| Freebsd | — | Upgrade jakarta-commons-httpclientUpgrade httpclientUpgrade apache-commons-httpclientUpgrade maven | Nov 4, 2022 | Apr 19, 2021 |
| Oracle Weblogic | — | Apply the Patch Set Update (PSU) 33727616 for version 12.2.1.4.0.Apply the Patch Set Update (PSU) 33727619 for version 14.1.1.0.0. | Feb 28, 2022 | Dec 2, 2020 |
| Oracle_linux | — | Upgrade slf4jUpgrade cdi-apiUpgrade apache-commons-codecUpgrade maven-resolver-transport-wagonUpgrade maven-openjdk17Upgrade plexus-utilsUpgrade maven-resolver-connector-basicUpgrade mavenUpgrade guavaUpgrade maven-shared-utilsUpgrade plexus-cipherUpgrade aopallianceUpgrade maven-wagon-provider-apiUpgrade jboss-interceptors-1.2-apiUpgrade google-guiceUpgrade plexus-classworldsUpgrade guava20Upgrade httpcomponents-clientUpgrade glassfish-el-apiUpgrade maven-wagon-http-sharedUpgrade maven-resolver-implUpgrade jcl-over-slf4jUpgrade maven-resolver-utilUpgrade jsoupUpgrade hawtjni-runtimeUpgrade plexus-sec-dispatcherUpgrade maven-openjdk8Upgrade atinjectUpgrade apache-commons-cliUpgrade plexus-interpolationUpgrade maven-resolverUpgrade jansi-nativeUpgrade maven-wagon-httpUpgrade maven-resolver-apiUpgrade sisu-injectUpgrade maven-openjdk11Upgrade jansiUpgrade httpcomponents-coreUpgrade apache-commons-lang3Upgrade apache-commons-ioUpgrade maven-wagonUpgrade maven-resolver-spiUpgrade geronimo-annotationUpgrade maven-wagon-fileUpgrade maven-libUpgrade apache-commons-loggingUpgrade jsr-305Upgrade plexus-containers-component-annotationsUpgrade sisu-plexusUpgrade sisu | May 18, 2022 | Oct 8, 2020 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Oct 8, 2020 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | Dec 2, 2020 |
| Redhat_linux | — | Upgrade mavenUpgrade cdi-apiUpgrade google-guiceUpgrade plexus-classworldsUpgrade maven-shared-utilsUpgrade hawtjni-runtimeUpgrade maven-resolver-utilUpgrade glassfish-el-apiUpgrade apache-commons-codecUpgrade maven-wagon-http-sharedUpgrade guava20Upgrade httpcomponents-clientUpgrade jsoupUpgrade jcl-over-slf4jUpgrade sisu-plexusUpgrade aopallianceUpgrade maven-resolver-implUpgrade maven-openjdk17Upgrade guavaUpgrade maven-resolver-transport-wagonUpgrade maven-resolver-connector-basicUpgrade maven-wagon-provider-apiUpgrade maven-wagon-fileUpgrade plexus-interpolationUpgrade jansiUpgrade jsr-305Upgrade sisu-injectUpgrade maven-wagonUpgrade apache-commons-ioUpgrade apache-commons-loggingUpgrade maven-libNo solution existsUpgrade geronimo-annotationUpgrade maven-resolverUpgrade maven-openjdk8Upgrade jboss-interceptors-1.2-apiUpgrade plexus-containers-component-annotationsUpgrade plexus-cipherUpgrade maven-resolver-apiUpgrade jansi-nativeUpgrade maven-wagon-httpUpgrade plexus-utilsUpgrade apache-commons-cliUpgrade atinjectUpgrade httpcomponents-coreUpgrade apache-commons-lang3Upgrade maven-resolver-spiUpgrade slf4jUpgrade plexus-sec-dispatcherUpgrade sisuUpgrade maven-openjdk11 | May 13, 2022 | Dec 2, 2020 |
| Rocky_linux | — | Upgrade jansi-native | Mar 5, 2024 | Dec 2, 2020 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.0.10Upgrade Splunk Enterprise to version 9.1.5Upgrade Splunk Enterprise to version 9.2.2 | Sep 30, 2025 | Dec 2, 2020 |
| Suse | — | Upgrade maven-libUpgrade maven | Aug 9, 2024 | Dec 2, 2020 |
| Ubuntu | — | Upgrade libhttpclient-java (Ubuntu Pro) | Mar 22, 2023 | Dec 2, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub