CVE-2017-14063: Input Validation
Async Http Client (aka async-http-client) before 2.0.35 can be tricked into connecting to a host different from the one extracted by java.net.URI if a '?' character occurs in a fragment identifier. Similar bugs were previously identified in cURL (CVE-2016-8624) and Oracle Java 8 java.net.URL.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2017-14063?
CVE-2017-14063 is classified as a medium severity vulnerability due to its potential to cause authentication bypass and denial of service.
How do I fix CVE-2017-14063?
To fix CVE-2017-14063, upgrade Async Http Client to version 2.0.35 or later.
What causes CVE-2017-14063?
CVE-2017-14063 is caused by improper parsing of the URI fragment identifier which can lead to connections being made to unintended hosts.
Which versions of Async Http Client are affected by CVE-2017-14063?
Async Http Client versions prior to 2.0.35 are affected by CVE-2017-14063.
What applications might be impacted by CVE-2017-14063?
Applications using Async Http Client below version 2.0.35 could be impacted by CVE-2017-14063.