cve.bz

CVE-2017-14063

7.5 highEPSS 3.0%

High (7.5) in asynchttpclient project async-http-client. EPSS 3.0% chance of exploitation in the next 30 days. Fixed in org.asynchttpclient:async-http-client 2.0.35.

Async Http Client (aka async-http-client) before 2.0.35 can be tricked into connecting to a host different from the one extracted by java.net.URI if a '?' character occurs in a fragment identifier. Similar bugs were previously identified in cURL (CVE-2016-8624) and Oracle Java 8 java.net.URL.

Severity

CVSS 3.0

7.5 high
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS
3.0% chance of exploitation in the next 30 days; higher than 87% of CVEs (scores of 2026-10-31)
CWE
CWE-20
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-93jq-624g-4p9pMavenorg.asynchttpclient:async-http-client<2.0.352.0.35

References

Check your stackJSON