Improper Input Validation in async-http-client

ALTO 7.5CVE-2017-14063 · GHSA-93jq-624g-4p9p · Published 31/08/2017 · updated 17/06/2026

Em resumo

CVE-2017-14063 é uma vulnerabilidade ALTO (CVSS 7.5) que afeta org.asynchttpclient:async-http-client, async-http-client (asynchttpclient project).
Chance de exploração nos próximos 30 dias (EPSS): 3.0%, maior que 87.5% das vulnerabilidades.
Correção: atualize para 2.0.35 ou posterior.

Package	Affected versions	Patched versions
org.asynchttpclient:async-http-client Maven	`< 2.0.35`	`2.0.35`
async-http-client asynchttpclient_project	`< 2.0.35`	`2.0.35`

Description

Async Http Client (aka async-http-client) before 2.0.35 can be tricked into connecting to a host different from the one extracted by java.net.URI if a '?' character occurs in a fragment identifier. Similar bugs were previously identified in cURL (CVE-2016-8624) and Oracle Java 8 java.net.URL.

NVD description

References

Mais vulnerabilidades de org.asynchttpclient:async-http-client

Ver tudo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free