CVE-2017-14063
Improper Input Validation in async-http-client
Async Http Client (aka async-http-client) before 2.0.35 can be tricked into connecting to a host different from the one extracted by java.net.URI if a '?' character occurs in a fragment identifier. Similar bugs were previously identified in cURL (CVE-2016-8624) and Oracle Java 8 java.net.URL.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Async Http Client (aka async-http-client) before 2.0.35 can be tricked into connecting to a host different from the one extracted by java.net.URI if a '?' character occurs in a fragment identifier. Similar bugs were previously identified in cURL (CVE-2016-8624) and Oracle Java 8 java.net.URL.
- Record
CVE-2017-14063- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
Async Http Client (aka async-http-client) before 2.0.35 can be tricked into connecting to a host different from the one extracted by java.net.URI if a '?' character occurs in a fragment identifier. Similar bugs were previously identified in cURL (CVE-2016-8624) and Oracle Java 8 java.net.URL.
- Record
CVE-2017-14063- Updated
- 2026-11-02
EUVDEUVD-2018-0557 No score
Async Http Client (aka async-http-client) before 2.0.35 can be tricked into connecting to a host different from the one extracted by java.net.URI if a '?' character occurs in a fragment identifier. Similar bugs were previously identified in cURL (CVE-2016-8624) and Oracle Java 8 java.net.URL.
- Record
EUVD-2018-0557- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-93jq-624g-4p9p
Improper Input Validation in async-http-client
Async Http Client (aka async-http-client) before 2.0.35 can be tricked into connecting to a host different from the one extracted by java.net.URI if a '?' character occurs in a fragment identifier. Similar bugs were previously identified in cURL (CVE-2016-8624) and Oracle Java 8 java.net.URL.
- Record
GHSA-93jq-624g-4p9p- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
Async Http Client (aka async-http-client) before 2.0.35 can be tricked into connecting to a host different from the one extracted by java.net.URI if a '?' character occurs in a fragment identifier. Similar bugs were previously identified in cURL (CVE-2016-8624) and Oracle Java 8 java.net.URL.
- Record
CVE-2017-14063- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVGHSA-93jq-624g-4p9p
Improper Input Validation in async-http-client
Async Http Client (aka async-http-client) before 2.0.35 can be tricked into connecting to a host different from the one extracted by java.net.URI if a '?' character occurs in a fragment identifier. Similar bugs were previously identified in cURL (CVE-2016-8624) and Oracle Java 8 java.net.URL.
- Record
GHSA-93jq-624g-4p9p- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.asynchttpclient:async-http-clientMaven |
before 2.0.35 | 2.0.35 |
org.asynchttpclient:async-http-clientMaven |
before 2.0.35, plus listed versions 2.0.02.0.0-RC12.0.0-RC102.0.0-RC112.0.0-RC12 Show 45 moreShow less2.0.0-RC132.0.0-RC142.0.0-RC152.0.0-RC162.0.0-RC172.0.0-RC182.0.0-RC192.0.0-RC22.0.0-RC202.0.0-RC212.0.0-RC32.0.0-RC42.0.0-RC52.0.0-RC62.0.0-RC72.0.0-RC82.0.0-RC92.0.0-alpha132.0.0-alpha142.0.0-alpha152.0.0-alpha162.0.0-alpha172.0.0-alpha182.0.0-alpha192.0.0-alpha202.0.0-alpha212.0.0-alpha222.0.0-alpha232.0.0-alpha242.0.0-alpha252.0.0-alpha262.0.0-alpha272.0.12.0.102.0.112.0.122.0.132.0.142.0.152.0.162.0.172.0.182.0.192.0.22.0.20 |
2.0.35 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-14063 is a high vulnerability (CVSS 7.5) in Asynchttpclient Project Async-http-client, published August 31, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.05%, the 87th percentile. Fixed in org.asynchttpclient:async-http-client 2.0.35.
References
github.com/AsyncHttpClient/async-http-client/issues/1455
access.redhat.com/errata/RHSA-2018:2669
openwall.com/lists/oss-security/2017/08/31/4
lists.apache.org/thread.html/rfaa4d578587f52a9c4d176af516a681a712c664e3be440a4163691d5%40%3Ccommits.pulsar.apache.org%3E
Show 50 moreShow less
nvd.nist.gov/vuln/detail/CVE-2017-14063
Left out here: 21 versions. The JSON record has them.