CVE-2017-14063

Async Http Client (aka async-http-client) before 2.0.35 can be tricked into connecting to a host different from the one extracted by java.net.URI if a '?'…

published August 31, 2017

CVSS
—
EPSS
3%
Percentile
87.4
In the wild
Unconfirmed
What it is

Async Http Client (aka async-http-client) before 2.0.35 can be tricked into connecting to a host different from the one extracted by java.net.URI if a '?' character occurs in a fragment identifier. Similar bugs were previously identified in cURL (CVE-2016-8624) and Oracle Java 8 java.net.URL.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.03046 · 87.4th percentile
Published
2017-08-31T16:00Z
EPSS history
Timeline
  • 31 AUG 16:00Z
    Async Http Client (aka async-http-client) before 2.0.35 can be tricked into connecting to a host different from the one extracted by java.net.URI if a '?'…
    cvelistv5