Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade cdi-apiUpgrade aopallianceUpgrade slf4jUpgrade mavenUpgrade plexus-classworldsUpgrade geronimo-annotationUpgrade maven-wagonUpgrade maven-resolver-transport-wagonUpgrade hawtjni-runtimeUpgrade jsoupUpgrade maven-openjdk17Upgrade sisuUpgrade maven-wagon-provider-apiUpgrade plexus-interpolationUpgrade sisu-injectUpgrade plexus-utilsUpgrade jboss-interceptors-1.2-apiUpgrade maven-libUpgrade plexus-sec-dispatcherUpgrade jcl-over-slf4jUpgrade guavaUpgrade httpcomponents-coreUpgrade apache-commons-codecUpgrade apache-commons-loggingUpgrade maven-wagon-fileUpgrade plexus-cipherUpgrade jsr-305Upgrade maven-resolver-connector-basicUpgrade apache-commons-lang3Upgrade maven-wagon-http-sharedUpgrade maven-resolver-apiUpgrade google-guiceUpgrade sisu-plexusUpgrade maven-resolverUpgrade guava20Upgrade plexus-containers-component-annotationsUpgrade glassfish-el-apiUpgrade maven-resolver-spiUpgrade jansiUpgrade maven-openjdk8Upgrade maven-openjdk11Upgrade maven-wagon-httpUpgrade maven-resolver-utilUpgrade httpcomponents-clientUpgrade atinjectUpgrade jansi-nativeUpgrade maven-shared-utilsUpgrade maven-resolver-implUpgrade apache-commons-ioUpgrade apache-commons-cli | May 13, 2022 | Dec 2, 2020 |
| Amazon Linux Ami 2 | — | Upgrade httpcomponents-client-javadocUpgrade httpcomponents-client | Feb 23, 2023 | Dec 2, 2020 |
| Centos_linux | — | Upgrade plexus-classworldsUpgrade plexus-utilsUpgrade maven-resolver-implUpgrade sisu-injectUpgrade maven-wagon-provider-apiUpgrade jboss-interceptors-1.2-apiUpgrade jsoupUpgrade maven-resolverUpgrade plexus-interpolationUpgrade atinjectUpgrade httpcomponents-coreUpgrade jsr-305Upgrade aopallianceUpgrade mavenUpgrade maven-wagon-httpUpgrade maven-wagon-http-sharedUpgrade maven-resolver-spiUpgrade jcl-over-slf4jUpgrade maven-libUpgrade guavaUpgrade geronimo-annotationUpgrade google-guiceUpgrade glassfish-el-apiUpgrade maven-resolver-utilUpgrade apache-commons-loggingUpgrade maven-wagonUpgrade cdi-apiUpgrade maven-resolver-transport-wagonUpgrade apache-commons-lang3Upgrade apache-commons-cliUpgrade plexus-containers-component-annotationsUpgrade maven-openjdk8Upgrade plexus-sec-dispatcherUpgrade sisu-plexusUpgrade guava20Upgrade maven-wagon-fileUpgrade jansi-nativeUpgrade maven-resolver-apiUpgrade maven-resolver-connector-basicUpgrade jansiUpgrade hawtjni-runtimeUpgrade apache-commons-codecUpgrade httpcomponents-clientUpgrade maven-openjdk17Upgrade sisuUpgrade maven-shared-utilsUpgrade plexus-cipherUpgrade maven-openjdk11Upgrade apache-commons-ioUpgrade slf4j | May 13, 2022 | Dec 2, 2020 |
| Debian | — | Upgrade httpcomponents-client | Oct 13, 2020 | Oct 13, 2020 |
| Freebsd | — | Upgrade mavenUpgrade apache-commons-httpclientUpgrade httpclientUpgrade jakarta-commons-httpclient | Nov 4, 2022 | Apr 19, 2021 |
| Oracle Weblogic | — | Apply the Patch Set Update (PSU) 33727619 for version 14.1.1.0.0.Apply the Patch Set Update (PSU) 33727616 for version 12.2.1.4.0. | Feb 28, 2022 | Dec 2, 2020 |
| Oracle_linux | — | Upgrade glassfish-el-apiUpgrade plexus-utilsUpgrade maven-resolver-utilUpgrade mavenUpgrade jcl-over-slf4jUpgrade google-guiceUpgrade guava20Upgrade plexus-classworldsUpgrade maven-openjdk17Upgrade plexus-cipherUpgrade jboss-interceptors-1.2-apiUpgrade jsoupUpgrade maven-resolver-implUpgrade aopallianceUpgrade maven-resolver-transport-wagonUpgrade guavaUpgrade httpcomponents-clientUpgrade slf4jUpgrade apache-commons-codecUpgrade maven-wagon-http-sharedUpgrade cdi-apiUpgrade maven-resolver-connector-basicUpgrade maven-wagon-provider-apiUpgrade maven-shared-utilsUpgrade apache-commons-loggingUpgrade apache-commons-cliUpgrade apache-commons-ioUpgrade maven-wagon-fileUpgrade geronimo-annotationUpgrade maven-wagonUpgrade plexus-interpolationUpgrade httpcomponents-coreUpgrade apache-commons-lang3Upgrade maven-openjdk8Upgrade maven-resolverUpgrade jansiUpgrade sisu-injectUpgrade maven-openjdk11Upgrade plexus-sec-dispatcherUpgrade sisu-plexusUpgrade sisuUpgrade hawtjni-runtimeUpgrade jansi-nativeUpgrade maven-libUpgrade maven-wagon-httpUpgrade maven-resolver-apiUpgrade atinjectUpgrade maven-resolver-spiUpgrade plexus-containers-component-annotationsUpgrade jsr-305 | May 18, 2022 | Oct 8, 2020 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Oct 8, 2020 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | Dec 2, 2020 |
| Redhat_linux | — | Upgrade atinjectUpgrade maven-resolver-spiNo solution existsUpgrade plexus-containers-component-annotationsUpgrade httpcomponents-coreUpgrade maven-resolver-apiUpgrade jansi-nativeUpgrade apache-commons-cliUpgrade apache-commons-ioUpgrade maven-libUpgrade plexus-sec-dispatcherUpgrade maven-resolver-connector-basicUpgrade plexus-interpolationUpgrade jsr-305Upgrade jansiUpgrade geronimo-annotationUpgrade maven-wagonUpgrade apache-commons-loggingUpgrade maven-openjdk11Upgrade plexus-cipherUpgrade maven-resolverUpgrade slf4jUpgrade jboss-interceptors-1.2-apiUpgrade plexus-utilsUpgrade maven-wagon-fileUpgrade maven-openjdk8Upgrade sisu-injectUpgrade apache-commons-lang3Upgrade sisuUpgrade maven-wagon-httpUpgrade maven-wagon-provider-apiUpgrade jcl-over-slf4jUpgrade maven-wagon-http-sharedUpgrade plexus-classworldsUpgrade maven-shared-utilsUpgrade guava20Upgrade maven-resolver-utilUpgrade httpcomponents-clientUpgrade maven-resolver-implUpgrade aopallianceUpgrade mavenUpgrade google-guiceUpgrade jsoupUpgrade glassfish-el-apiUpgrade maven-resolver-transport-wagonUpgrade sisu-plexusUpgrade apache-commons-codecUpgrade guavaUpgrade cdi-apiUpgrade hawtjni-runtimeUpgrade maven-openjdk17 | May 13, 2022 | Dec 2, 2020 |
| Rocky_linux | — | Upgrade jansi-native | Mar 5, 2024 | Dec 2, 2020 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.2.2Upgrade Splunk Enterprise to version 9.1.5Upgrade Splunk Enterprise to version 9.0.10 | Sep 30, 2025 | Dec 2, 2020 |
| Suse | — | Upgrade maven-libUpgrade maven | Aug 9, 2024 | Dec 2, 2020 |
| Ubuntu | — | Upgrade libhttpclient-java (Ubuntu Pro) | Mar 22, 2023 | Dec 2, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub