Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | alma-upgrade-aopalliancealma-upgrade-apache-commons-clialma-upgrade-apache-commons-codecalma-upgrade-apache-commons-ioalma-upgrade-apache-commons-lang3alma-upgrade-apache-commons-loggingalma-upgrade-atinjectalma-upgrade-cdi-apialma-upgrade-geronimo-annotationalma-upgrade-glassfish-el-apialma-upgrade-google-guicealma-upgrade-guavaalma-upgrade-guava20alma-upgrade-hawtjni-runtimealma-upgrade-httpcomponents-clientalma-upgrade-httpcomponents-corealma-upgrade-jansialma-upgrade-jansi-nativealma-upgrade-jboss-interceptors-1.2-apialma-upgrade-jcl-over-slf4jalma-upgrade-jsoupalma-upgrade-jsr-305alma-upgrade-mavenalma-upgrade-maven-libalma-upgrade-maven-openjdk11alma-upgrade-maven-openjdk17alma-upgrade-maven-openjdk8alma-upgrade-maven-resolveralma-upgrade-maven-resolver-apialma-upgrade-maven-resolver-connector-basicalma-upgrade-maven-resolver-implalma-upgrade-maven-resolver-spialma-upgrade-maven-resolver-transport-wagonalma-upgrade-maven-resolver-utilalma-upgrade-maven-shared-utilsalma-upgrade-maven-wagonalma-upgrade-maven-wagon-filealma-upgrade-maven-wagon-httpalma-upgrade-maven-wagon-http-sharedalma-upgrade-maven-wagon-provider-apialma-upgrade-plexus-cipheralma-upgrade-plexus-classworldsalma-upgrade-plexus-containers-component-annotationsalma-upgrade-plexus-interpolationalma-upgrade-plexus-sec-dispatcheralma-upgrade-plexus-utilsalma-upgrade-sisualma-upgrade-sisu-injectalma-upgrade-sisu-plexusalma-upgrade-slf4j | May 13, 2022 | Dec 2, 2020 | |
| Amazon Linux Ami 2 | amazon-linux-ami-2-upgrade-httpcomponents-clientamazon-linux-ami-2-upgrade-httpcomponents-client-javadoc | Feb 23, 2023 | Dec 2, 2020 | |
| Centos_linux | — | centos-upgrade-aopalliancecentos-upgrade-apache-commons-clicentos-upgrade-apache-commons-codeccentos-upgrade-apache-commons-iocentos-upgrade-apache-commons-lang3centos-upgrade-apache-commons-loggingcentos-upgrade-atinjectcentos-upgrade-cdi-apicentos-upgrade-geronimo-annotationcentos-upgrade-glassfish-el-apicentos-upgrade-google-guicecentos-upgrade-guavacentos-upgrade-guava20centos-upgrade-hawtjni-runtimecentos-upgrade-httpcomponents-clientcentos-upgrade-httpcomponents-corecentos-upgrade-jansicentos-upgrade-jansi-nativecentos-upgrade-jboss-interceptors-1-2-apicentos-upgrade-jcl-over-slf4jcentos-upgrade-jsoupcentos-upgrade-jsr-305centos-upgrade-mavencentos-upgrade-maven-libcentos-upgrade-maven-openjdk11centos-upgrade-maven-openjdk17centos-upgrade-maven-openjdk8centos-upgrade-maven-resolvercentos-upgrade-maven-resolver-apicentos-upgrade-maven-resolver-connector-basiccentos-upgrade-maven-resolver-implcentos-upgrade-maven-resolver-spicentos-upgrade-maven-resolver-transport-wagoncentos-upgrade-maven-resolver-utilcentos-upgrade-maven-shared-utilscentos-upgrade-maven-wagoncentos-upgrade-maven-wagon-filecentos-upgrade-maven-wagon-httpcentos-upgrade-maven-wagon-http-sharedcentos-upgrade-maven-wagon-provider-apicentos-upgrade-plexus-ciphercentos-upgrade-plexus-classworldscentos-upgrade-plexus-containers-component-annotationscentos-upgrade-plexus-interpolationcentos-upgrade-plexus-sec-dispatchercentos-upgrade-plexus-utilscentos-upgrade-sisucentos-upgrade-sisu-injectcentos-upgrade-sisu-plexuscentos-upgrade-slf4j | May 13, 2022 | Dec 2, 2020 |
| Debian | debian-upgrade-httpcomponents-client | Oct 13, 2020 | Oct 13, 2020 | |
| Freebsd | freebsd-upgrade-package-maven | Nov 4, 2022 | Apr 19, 2021 | |
| Oracle Weblogic | oracle-weblogic-jan-2022-cpu-12_2_1_4_0oracle-weblogic-jan-2022-cpu-14_1_1_0_0 | Feb 28, 2022 | Dec 2, 2020 | |
| Oracle_linux | — | oracle-linux-upgrade-aopallianceoracle-linux-upgrade-apache-commons-clioracle-linux-upgrade-apache-commons-codecoracle-linux-upgrade-apache-commons-iooracle-linux-upgrade-apache-commons-lang3oracle-linux-upgrade-apache-commons-loggingoracle-linux-upgrade-atinjectoracle-linux-upgrade-cdi-apioracle-linux-upgrade-geronimo-annotationoracle-linux-upgrade-glassfish-el-apioracle-linux-upgrade-google-guiceoracle-linux-upgrade-guavaoracle-linux-upgrade-guava20oracle-linux-upgrade-hawtjni-runtimeoracle-linux-upgrade-httpcomponents-clientoracle-linux-upgrade-httpcomponents-coreoracle-linux-upgrade-jansioracle-linux-upgrade-jansi-nativeoracle-linux-upgrade-jboss-interceptors-1-2-apioracle-linux-upgrade-jcl-over-slf4joracle-linux-upgrade-jsouporacle-linux-upgrade-jsr-305oracle-linux-upgrade-mavenoracle-linux-upgrade-maven-liboracle-linux-upgrade-maven-openjdk11oracle-linux-upgrade-maven-openjdk17oracle-linux-upgrade-maven-openjdk8oracle-linux-upgrade-maven-resolveroracle-linux-upgrade-maven-resolver-apioracle-linux-upgrade-maven-resolver-connector-basicoracle-linux-upgrade-maven-resolver-imploracle-linux-upgrade-maven-resolver-spioracle-linux-upgrade-maven-resolver-transport-wagonoracle-linux-upgrade-maven-resolver-utiloracle-linux-upgrade-maven-shared-utilsoracle-linux-upgrade-maven-wagonoracle-linux-upgrade-maven-wagon-fileoracle-linux-upgrade-maven-wagon-httporacle-linux-upgrade-maven-wagon-http-sharedoracle-linux-upgrade-maven-wagon-provider-apioracle-linux-upgrade-plexus-cipheroracle-linux-upgrade-plexus-classworldsoracle-linux-upgrade-plexus-containers-component-annotationsoracle-linux-upgrade-plexus-interpolationoracle-linux-upgrade-plexus-sec-dispatcheroracle-linux-upgrade-plexus-utilsoracle-linux-upgrade-sisuoracle-linux-upgrade-sisu-injectoracle-linux-upgrade-sisu-plexusoracle-linux-upgrade-slf4j | May 18, 2022 | Oct 8, 2020 |
| Red Hat Jboss Eap | red-hat-jboss-eap-upgrade-latest | Sep 19, 2024 | Oct 8, 2020 | |
| Redhat_linux | redhat-upgrade-aopallianceredhat-upgrade-apache-commons-cliredhat-upgrade-apache-commons-codecredhat-upgrade-apache-commons-ioredhat-upgrade-apache-commons-lang3redhat-upgrade-apache-commons-loggingredhat-upgrade-atinjectredhat-upgrade-cdi-apiredhat-upgrade-geronimo-annotationredhat-upgrade-glassfish-el-apiredhat-upgrade-google-guiceredhat-upgrade-guavaredhat-upgrade-guava20redhat-upgrade-hawtjni-runtimeredhat-upgrade-httpcomponents-clientredhat-upgrade-httpcomponents-coreredhat-upgrade-jansiredhat-upgrade-jansi-nativeredhat-upgrade-jboss-interceptors-1-2-apiredhat-upgrade-jcl-over-slf4jredhat-upgrade-jsoupredhat-upgrade-jsr-305redhat-upgrade-mavenredhat-upgrade-maven-libredhat-upgrade-maven-openjdk11redhat-upgrade-maven-openjdk17redhat-upgrade-maven-openjdk8redhat-upgrade-maven-resolverredhat-upgrade-maven-resolver-apiredhat-upgrade-maven-resolver-connector-basicredhat-upgrade-maven-resolver-implredhat-upgrade-maven-resolver-spiredhat-upgrade-maven-resolver-transport-wagonredhat-upgrade-maven-resolver-utilredhat-upgrade-maven-shared-utilsredhat-upgrade-maven-wagonredhat-upgrade-maven-wagon-fileredhat-upgrade-maven-wagon-httpredhat-upgrade-maven-wagon-http-sharedredhat-upgrade-maven-wagon-provider-apiredhat-upgrade-plexus-cipherredhat-upgrade-plexus-classworldsredhat-upgrade-plexus-containers-component-annotationsredhat-upgrade-plexus-interpolationredhat-upgrade-plexus-sec-dispatcherredhat-upgrade-plexus-utilsredhat-upgrade-sisuredhat-upgrade-sisu-injectredhat-upgrade-sisu-plexusredhat-upgrade-slf4j | May 13, 2022 | Dec 2, 2020 | |
| Rocky_linux | rocky-upgrade-jansi-native | Mar 5, 2024 | Dec 2, 2020 | |
| Splunk | splunk-upgrade-latest | Sep 30, 2025 | Dec 2, 2020 | |
| Suse | — | suse-upgrade-mavensuse-upgrade-maven-lib | Aug 9, 2024 | Dec 2, 2020 |
| Ubuntu | ubuntu-pro-upgrade-libhttpclient-java | Mar 22, 2023 | Dec 2, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub