Async Http Client (aka async-http-client) before 2.0.35 can be tricked into connecting to a host different from the one extracted by…

Description

Async Http Client (aka async-http-client) before 2.0.35 can be tricked into connecting to a host different from the one extracted by java.net.URI if a '?' character occurs in a fragment identifier. Similar bugs were previously identified in cURL (CVE-2016-8624) and Oracle Java 8 java.net.URL.

Scores

EPSS (exploitation in 30 days)

3.0% · top 12% of all CVEs (4 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.

Weakness

• n/a
• CWE-20 (opens in a new tab)All about CWE-20 and its CVEs

Affected products

• n/a

  • affected n/a

Affected packages

From reviewed advisories of the GitHub Advisory Database.

• Mavenorg.asynchttpclient:async-http-clientGHSA-93jq-624g-4p9p (opens in a new tab)

References (28)

• https://github.com/AsyncHttpClient/async-http-client/issues/1455 (opens in a new tab)x_refsource_MISCx_transferred
• RHSA-2018:2669 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• http://openwall.com/lists/oss-security/2017/08/31/4 (opens in a new tab)x_refsource_MISCx_transferred
• [pulsar-commits] 20200914 [GitHub] [pulsar] klwilson227 opened a new issue #8061: CVE-2017-14063 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [pulsar-commits] 20200924 [GitHub] [pulsar] jiazhai closed issue #8061: CVE-2017-14063 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [pulsar-commits] 20200925 [GitHub] [pulsar] jiazhai closed issue #8061: CVE-2017-14063 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [tez-issues] 20201002 [jira] [Created] (TEZ-4237) Upgrade async-http-client-1.9.40 due to CVE-2017-14063 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [tez-issues] 20201002 [jira] [Assigned] (TEZ-4237) Upgrade async-http-client-1.9.40 due to CVE-2017-14063 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [tez-dev] 20201002 [jira] [Created] (TEZ-4237) Upgrade async-http-client-1.9.40 due to CVE-2017-14063 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [tez-issues] 20201004 [jira] [Updated] (TEZ-4237) Upgrade async-http-client-1.9.40 due to CVE-2017-14063 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [tez-issues] 20201004 [jira] [Commented] (TEZ-4237) Upgrade async-http-client-1.9.40 due to CVE-2017-14063 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [tez-issues] 20201005 [jira] [Updated] (TEZ-4237) Upgrade async-http-client-1.9.40 due to CVE-2017-14063 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [tez-issues] 20201005 [jira] [Commented] (TEZ-4237) Upgrade async-http-client-1.9.40 due to CVE-2017-14063 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [tez-issues] 20201009 [jira] [Updated] (TEZ-4237) Upgrade async-http-client-1.9.40 due to CVE-2017-14063 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [tez-issues] 20201009 [jira] [Commented] (TEZ-4237) Upgrade async-http-client-1.9.40 due to CVE-2017-14063 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [tez-issues] 20201014 [jira] [Updated] (TEZ-4237) Upgrade async-http-client-1.9.40 due to CVE-2017-14063 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [tez-issues] 20201014 [jira] [Commented] (TEZ-4237) Upgrade async-http-client-1.9.40 due to CVE-2017-14063 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [tez-issues] 20201020 [jira] [Updated] (TEZ-4237) Upgrade async-http-client-1.9.40 due to CVE-2017-14063 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [tez-issues] 20201020 [jira] [Commented] (TEZ-4237) Upgrade async-http-client-1.9.40 due to CVE-2017-14063 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [tez-issues] 20201021 [jira] [Updated] (TEZ-4237) Upgrade async-http-client-1.9.40 due to CVE-2017-14063 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [tez-issues] 20201021 [jira] [Commented] (TEZ-4237) Upgrade async-http-client-1.9.40 due to CVE-2017-14063 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [tez-issues] 20201110 [jira] [Commented] (TEZ-4237) Upgrade async-http-client-1.9.40 due to CVE-2017-14063 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [tez-issues] 20201111 [jira] [Commented] (TEZ-4237) Upgrade async-http-client-1.9.40 due to CVE-2017-14063 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• https://lists.apache.org/thread.html/r0a6b6429a7558051dbb70bd06584b4b1c334a80ec9203d3d39b7045a%40%3Ccommits.tez.apache.org%3E (opens in a new tab)x_refsource_MISCx_transferred
• https://lists.apache.org/thread.html/rfe55d83e4070bcc9285bbbf6bc39635dbcbba6d14d89aab0f339c83a%40%3Ccommits.tez.apache.org%3E (opens in a new tab)x_refsource_MISCx_transferred
• [tez-issues] 20201111 [jira] [Updated] (TEZ-4237) Upgrade async-http-client-1.9.40 due to CVE-2017-14063 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [tez-dev] 20201112 Build failed in Jenkins: Tez-qbt-0.10-Build #12 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [pulsar-commits] 20201215 [GitHub] [pulsar] yanshuchong opened a new issue #8967: CVSS issue list (opens in a new tab)mailing-listx_refsource_MLISTx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisory GHSA-93jq-624g-4p9p (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2017-14063](https://trackcve.app/badge/CVE-2017-14063.svg)](https://trackcve.app/cve/CVE-2017-14063)

Record last updated 5 Aug 2024, 19:13 UTC.