CVE-2022-32531
Apache BookKeeper: Java Client Uses Connection to Host that Failed Hostname Verification
The Apache Bookkeeper Java Client (before 4.14.6 and also 4.15.0) does not close the connection to the bookkeeper server when TLS hostname verification fails. This leaves the bookkeeper client vulnerable to a man in the middle attack.
The problem affects BookKeeper client prior to versions 4.14.6 and 4.15.1.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
The Apache Bookkeeper Java Client (before 4.14.6 and also 4.15.0) does not close the connection to the bookkeeper server when TLS hostname verification fails. This leaves the bookkeeper client vulnerable to a man in the middle attack.
The problem affects BookKeeper client prior to versions 4.14.6 and 4.15.1.
- Record
CVE-2022-32531- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-295
- Updated
- 2026-11-02
CVE List
Apache BookKeeper: Java Client Uses Connection to Host that Failed Hostname Verification
The Apache Bookkeeper Java Client (before 4.14.6 and also 4.15.0) does not close the connection to the bookkeeper server when TLS hostname verification fails. This leaves the bookkeeper client vulnerable to a man in the middle attack.
The problem affects BookKeeper client prior to versions 4.14.6 and 4.15.1.
- Record
CVE-2022-32531- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-295
- Updated
- 2026-11-02
EUVDEUVD-2022-0020
The Apache Bookkeeper Java Client (before 4.14.6 and also 4.15.0) does not close the connection to the bookkeeper server when TLS hostname verification fails. This leaves the bookkeeper client vulnerable to a man in the middle attack.
The problem affects BookKeeper client prior to versions 4.14.6 and 4.15.1.
- Record
EUVD-2022-0020- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-gxq5-79m2-gvvq
Apache Bookkeeper vulnerable to Improper Certificate Validation
The Apache Bookkeeper Java Client (before 4.14.6 and also 4.15.0) does not close the connection to the bookkeeper server when TLS hostname verification fails. This leaves the bookkeeper client vulnerable to a man in the middle attack. The problem affects BookKeeper client prior to versions 4.14.6 and 4.15.1.
- Record
GHSA-gxq5-79m2-gvvq- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-295
- Updated
- 2026-11-02
OSV
Apache BookKeeper: Java Client Uses Connection to Host that Failed Hostname Verification
The Apache Bookkeeper Java Client (before 4.14.6 and also 4.15.0) does not close the connection to the bookkeeper server when TLS hostname verification fails. This leaves the bookkeeper client vulnerable to a man in the middle attack.
The problem affects BookKeeper client prior to versions 4.14.6 and 4.15.1.
- Record
CVE-2022-32531- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-295
- Updated
- 2026-11-02
OSVGHSA-gxq5-79m2-gvvq
Apache Bookkeeper vulnerable to Improper Certificate Validation
The Apache Bookkeeper Java Client (before 4.14.6 and also 4.15.0) does not close the connection to the bookkeeper server when TLS hostname verification fails. This leaves the bookkeeper client vulnerable to a man in the middle attack. The problem affects BookKeeper client prior to versions 4.14.6 and 4.15.1.
- Record
GHSA-gxq5-79m2-gvvq- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-295
- Updated
- 2026-11-02
OSVPYSEC-2022-43060
The Apache Bookkeeper Java Client (before 4.14.6 and also 4.15.0) does not close the connection to the bookkeeper server when TLS hostname verification fails. This leaves the bookkeeper client vulnerable to a man in the middle attack.
The problem affects BookKeeper client prior to versions 4.14.6 and 4.15.1.
- Record
PYSEC-2022-43060- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2022-32531
The Apache Bookkeeper Java Client (before 4.14.6 and also 4.15.0) does not close the connection to the bookkeeper server when TLS hostname verification fails. This leaves the bookkeeper client vulnerable to a man in the middle attack. The problem affects BookKeeper client prior to versions 4.14.6 and 4.15.1.
- Record
UBUNTU-CVE-2022-32531- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.bookkeeper:bookkeeper-commonMaven |
before 4.14.6 | 4.14.6 |
org.apache.bookkeeper:bookkeeper-commonMaven |
4.15.0 to 4.15.0 | 4.15.1 |
org.apache.bookkeeper:bookkeeper-commonMaven |
before 4.14.6, plus listed versions 4.10.04.11.04.11.14.12.04.12.1 Show 20 moreShow less4.13.04.14.04.14.14.14.24.14.34.14.44.14.54.6.04.6.14.6.24.7.04.7.14.7.24.7.34.8.04.8.14.8.24.9.04.9.14.9.2 |
4.14.6 |
org.apache.bookkeeper:bookkeeper-commonMaven |
4.15.0 up to 4.15.1 | 4.15.1 |
apache-bookkeeper-clientPyPI |
before 4.14.6, plus listed versions 4.10.04.11.04.11.14.12.04.12.0a0 Show 12 moreShow less4.12.14.13.04.14.04.14.14.14.24.14.54.9.04.9.0a14.9.0a24.9.0a34.9.14.9.2 |
4.14.6 |
bookkeeperUbuntu:16.04:LTS |
All versions, plus listed versions 4.2.4-24.2.4-3 |
None known |
bookkeeperUbuntu:18.04:LTS |
All versions, plus listed versions 4.4.0-1 |
None known |
bookkeeperUbuntu:20.04:LTS |
All versions, plus listed versions 4.4.0-1 |
None known |
bookkeeperUbuntu:22.04:LTS |
All versions, plus listed versions 4.4.0-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-32531 is a medium vulnerability (CVSS 5.9) in Apache Bookkeeper, published December 15, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.09%, the 65th percentile. Fixed in org.apache.bookkeeper:bookkeeper-common 4.14.6.
References
lists.apache.org/thread/xyk2lfc7lzof8mksmwyympbqxts1b5s9
nvd.nist.gov/vuln/detail/CVE-2022-32531
github.com/pypa/advisory-database/tree/main/vulns/apache-bookkeeper-client/PYSEC-2022-43060.yaml
ubuntu.com/security/CVE-2022-32531
cve.org/CVERecord?id=CVE-2022-32531