{"id":"CVE-2015-5262","aliases":["CLSA-2026-1791188247","CLSA-2026-1791370172","CLSA-2026-1791898676","CLSA-2026-1791960465","CLSA-2026-1792010907","CLSA-2026-1792743930","CLSA-2026-1793886120","CLSA-2026-1793886295","DEBIAN-CVE-2015-5262","DLA-322-1","EUVD-2018-0592","GHSA-fmj5-wv96-r2ch","MGASA-2015-0392","SUSE-SU-2020:3149-1","SUSE-SU-2020:3151-1","SUSE-SU-2020:3152-1","UBUNTU-CVE-2015-5262","USN-2769-1","openSUSE-SU-2020:1873-1","openSUSE-SU-2020:1875-1","openSUSE-SU-2024:10621-1"],"status":"published","title":"Denial of service vulnerability in org.apache.httpcomponents:httpclient","description":"http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the http.socket.timeout configuration setting during an SSL handshake, which allows remote attackers to cause a denial of service (HTTPS call hang) via unspecified vectors.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.1876,"percentile":0.97297,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-399"],"published":"2015-09-30T00:00:00Z","modified":"2026-11-06T13:15:20Z","fixes":[{"ecosystem":"Maven","package":"org.apache.httpcomponents:httpclient","fixed_in":["4.3.6"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:Maven","package":"org.apache.httpcomponents:httpclient","fixed_in":["4.2.1-tuxcare.3","4.2-tuxcare.3"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"commons-httpclient","fixed_in":["3.1-12"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"commons-httpclient","fixed_in":["3.1-12"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"commons-httpclient","fixed_in":["3.1-12"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"httpcomponents-client","fixed_in":["4.3.6-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"httpcomponents-client","fixed_in":["4.3.6-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"httpcomponents-client","fixed_in":["4.3.6-1"],"sources":["osv"]},{"ecosystem":"Debian:6.0","package":"commons-httpclient","fixed_in":["3.1-9+deb6u2"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"jakarta-commons-httpclient","fixed_in":["3.1-15.1.mga5"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"httpcomponents-client","fixed_in":["4.3.6-1.mga5"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"commons-httpclient","fixed_in":["3.1-10.2ubuntu0.14.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"httpcomponents-client","fixed_in":["4.3.3-1ubuntu0.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"commons-httpclient","fixed_in":["3.1-11ubuntu1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.httpcomponents:httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.6"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.httpcomponents:httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.6"},{"fixed":"4.2.6-tuxcare.2"}]}],"versions":["4.2.6","4.2.6-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.httpcomponents:httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.1"},{"fixed":"4.2.1-tuxcare.3"}]}],"versions":["4.2.1","4.2.1-tuxcare.1","4.2.1-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.httpcomponents:httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2"},{"fixed":"4.2-tuxcare.3"}]}],"versions":["4.2","4.2-tuxcare.1","4.2-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.httpcomponents:httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.2"},{"fixed":"4.1.2-tuxcare.1"}]}],"versions":["4.1.2"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.httpcomponents:httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.1"},{"fixed":"4.0.1-tuxcare.2"}]}],"versions":["4.0.1","4.0.1-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.httpcomponents:httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.2"},{"fixed":"4.2.2-tuxcare.1"}]}],"versions":["4.2.2"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.httpcomponents:httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.5"},{"fixed":"4.2.5-tuxcare.1"}]}],"versions":["4.2.5"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.httpcomponents:httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.3"},{"fixed":"4.1.3-tuxcare.1"}]}],"versions":["4.1.3"],"bundled":5},{"source":"osv","ecosystem":"Debian:12","package":"commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1-12"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1-12"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1-12"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"httpcomponents-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.6-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"httpcomponents-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.6-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"httpcomponents-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.6-1"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1-9+deb6u2"}]}],"versions":["3.1-9"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.httpcomponents:httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.6"}]}],"versions":["4.0","4.0-alpha1","4.0-alpha2","4.0-alpha3","4.0-alpha4","4.0-beta1","4.0-beta2","4.0.1","4.0.2","4.0.3","4.1","4.1-alpha1","4.1-alpha2","4.1-beta1","4.1.1","4.1.2","4.1.3","4.2","4.2-alpha1","4.2-beta1","4.2.1","4.2.2","4.2.3","4.2.4","4.2.5","4.2.6","4.3","4.3-alpha1","4.3-beta1","4.3-beta2","4.3.1","4.3.2","4.3.3","4.3.4","4.3.5"]},{"source":"osv","ecosystem":"Mageia:5","package":"jakarta-commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1-15.1.mga5"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"httpcomponents-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.6-1.mga5"}]}]},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"apache-commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1-6.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"apache-commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1-6.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"apache-commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1-6.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"apache-commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1-6.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"apache-commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1-6.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"apache-commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1-6.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"apache-commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1-6.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"apache-commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1-6.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"apache-commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1-6.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"apache-commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1-6.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"apache-commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1-6.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"apache-commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1-6.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"apache-commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1-6.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"apache-commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1-6.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"apache-commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1-6.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"apache-commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1-6.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 5","package":"apache-commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1-6.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"apache-commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1-4.3.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"apache-commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1-4.3.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"apache-commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1-4.3.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"apache-commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1-4.3.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"apache-commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1-4.3.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"apache-commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1-11.3.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1-10.2ubuntu0.14.04.1"}]}],"versions":["3.1-10.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"httpcomponents-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.3-1ubuntu0.1+esm1"}]}],"versions":["4.2.5-2","4.3.2-1","4.3.3-1","4.3.3-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1-11ubuntu1"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1-10.2ubuntu0.14.04.1"}]}],"versions":["3.1-10.2"],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"apache-commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1-lp151.4.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"apache-commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1-lp152.6.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"apache-commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1-13.4"}]}],"bundled":2}],"products":[{"vendor":"apache","product":"httpclient"},{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"fedoraproject","product":"fedora"}],"references":[{"url":"http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","tags":["x_refsource_CONFIRM","x_transferred","advisory","web"]},{"url":"http://svn.apache.org/viewvc?view=revision\u0026revision=1626784","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://jenkins.io/security/advisory/2018-02-26/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1261538","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory","advisory","report","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-October/167962.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-October/167999.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://issues.apache.org/jira/browse/HTTPCLIENT-1478","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168030.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://www.securitytracker.com/id/1033743","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"http://www.ubuntu.com/usn/USN-2769-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00032.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00033.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-5262","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-fmj5-wv96-r2ch","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E","tags":["web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-5262","tags":["advisory"]},{"url":"https://jenkins.io/security/advisory/2018-02-26","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2015-0392.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=16870","tags":["report"]},{"url":"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5262","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20203149-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1178171","tags":["report"]},{"url":"https://bugzilla.suse.com/945190","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3577","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5262","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20203151-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20203152-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2015-5262","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2769-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-5262","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2012-5783","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2012-6153","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-3577","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/YYYTF4MJKJCHN6CREKINZ6NZL66SOXHJ/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/UMLTVDGHZRB3F3GUJJIBKNM256N34XBW/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2015-5262","description":"http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the http.socket.timeout configuration setting during an SSL handshake, which allows remote attackers to cause a denial of service (HTTPS call hang) via unspecified vectors.","status":"published","published":"2015-10-27T16:00:00Z","modified":"2024-08-06T06:41:09.189Z","updated_at":"2026-11-02T14:35:40.217028Z"}],"euvd":[{"id":"EUVD-2018-0592","description":"http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the http.socket.timeout configuration setting during an SSL handshake, which allows remote attackers to cause a denial of service (HTTPS call hang) via unspecified vectors.","status":"published","published":"2015-10-27T16:00:00Z","modified":"2024-08-06T06:41:09Z","updated_at":"2026-11-03T02:22:00.305488Z"}],"ghsa":[{"id":"GHSA-fmj5-wv96-r2ch","title":"Denial of service vulnerability in org.apache.httpcomponents:httpclient","description":"http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the http.socket.timeout configuration setting during an SSL handshake, which allows remote attackers to cause a denial of service (HTTPS call hang) via unspecified vectors.","status":"published","published":"2018-10-17T00:05:29Z","modified":"2023-02-13T18:20:06Z","updated_at":"2026-11-02T14:36:44.81167Z"}],"nvd":[{"id":"CVE-2015-5262","description":"http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the http.socket.timeout configuration setting during an SSL handshake, which allows remote attackers to cause a denial of service (HTTPS call hang) via unspecified vectors.","status":"published","published":"2015-10-27T16:59:07.557Z","modified":"2026-06-17T00:28:46.787Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-399"],"updated_at":"2026-11-02T14:03:12.30866Z"}],"osv":[{"id":"CLSA-2026-1791188247","title":"TuxCare security update for org.apache.httpcomponents:httpclient (2 CVEs)","description":"TuxCare rebuilt org.apache.httpcomponents:httpclient to address 2 CVEs. Fixed in 4.2.6-tuxcare.2.","status":"published","published":"2026-10-05T08:17:27Z","modified":"2026-11-02T19:46:26.150153364Z","updated_at":"2026-11-02T20:29:22.637147Z"},{"id":"CLSA-2026-1791370172","title":"TuxCare security update for org.apache.httpcomponents:httpclient (1 CVE)","description":"TuxCare rebuilt org.apache.httpcomponents:httpclient to address 1 CVE. Fixed in 4.2.1-tuxcare.3.","status":"published","published":"2026-10-07T10:49:32Z","modified":"2026-11-02T19:46:26.261600468Z","updated_at":"2026-11-02T20:29:17.805906Z"},{"id":"CLSA-2026-1791898676","title":"TuxCare security update for org.apache.httpcomponents:httpclient (1 CVE)","description":"TuxCare rebuilt org.apache.httpcomponents:httpclient to address 1 CVE. Fixed in 4.2-tuxcare.3.","status":"published","published":"2026-10-13T13:37:56Z","modified":"2026-11-02T19:46:27.278517363Z","updated_at":"2026-11-02T20:29:13.152182Z"},{"id":"CLSA-2026-1791960465","title":"TuxCare security update for org.apache.httpcomponents:httpclient (3 CVEs)","description":"TuxCare rebuilt org.apache.httpcomponents:httpclient to address 3 CVEs. Fixed in 4.1.2-tuxcare.1.","status":"published","published":"2026-10-14T06:47:45Z","modified":"2026-11-02T19:46:27.306917297Z","updated_at":"2026-11-02T20:29:13.152182Z"},{"id":"CLSA-2026-1792010907","title":"TuxCare security update for org.apache.httpcomponents:httpclient (2 CVEs)","description":"TuxCare rebuilt org.apache.httpcomponents:httpclient to address 2 CVEs. Fixed in 4.0.1-tuxcare.2.","status":"published","published":"2026-10-14T20:48:27Z","modified":"2026-11-02T19:46:28.028666288Z","updated_at":"2026-11-02T20:29:13.152182Z"},{"id":"CLSA-2026-1792743930","title":"TuxCare security update for org.apache.httpcomponents:httpclient (3 CVEs)","description":"TuxCare rebuilt org.apache.httpcomponents:httpclient to address 3 CVEs. Fixed in 4.2.2-tuxcare.1.","status":"published","published":"2026-10-23T08:25:30Z","modified":"2026-11-02T19:46:30.998382044Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1793886120","title":"TuxCare security update for org.apache.httpcomponents:httpclient (4 CVEs)","description":"TuxCare rebuilt org.apache.httpcomponents:httpclient to address 4 CVEs. Fixed in 4.2.5-tuxcare.1.","status":"published","published":"2026-11-05T14:42:01Z","modified":"2026-11-06T13:15:20.816569639Z","updated_at":"2026-11-06T13:44:09.891978Z"},{"id":"CLSA-2026-1793886295","title":"TuxCare security update for org.apache.httpcomponents:httpclient (5 CVEs)","description":"TuxCare rebuilt org.apache.httpcomponents:httpclient to address 5 CVEs. Fixed in 4.1.3-tuxcare.1.","status":"published","published":"2026-11-05T14:44:56Z","modified":"2026-11-06T13:15:20.815432202Z","updated_at":"2026-11-06T13:44:09.891978Z"},{"id":"CVE-2015-5262","description":"http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the http.socket.timeout configuration setting during an SSL handshake, which allows remote attackers to cause a denial of service (HTTPS call hang) via unspecified vectors.","status":"published","published":"2015-10-27T16:59:07Z","modified":"2026-04-16T06:18:34.719269402Z","updated_at":"2026-11-02T15:44:00.594921Z"},{"id":"DEBIAN-CVE-2015-5262","description":"http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the http.socket.timeout configuration setting during an SSL handshake, which allows remote attackers to cause a denial of service (HTTPS call hang) via unspecified vectors.","status":"published","published":"2015-10-27T16:59:07.557Z","modified":"2026-09-09T06:47:28.672285587Z","updated_at":"2026-11-02T15:45:26.752992Z"},{"id":"DLA-322-1","title":"commons-httpclient - security update","status":"published","published":"2015-09-30T00:00:00Z","modified":"2026-03-09T01:19:09.744837Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"GHSA-fmj5-wv96-r2ch","title":"Denial of service vulnerability in org.apache.httpcomponents:httpclient","description":"http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the http.socket.timeout configuration setting during an SSL handshake, which allows remote attackers to cause a denial of service (HTTPS call hang) via unspecified vectors.","status":"published","published":"2018-10-17T00:05:29Z","modified":"2024-12-08T05:23:13.492634Z","updated_at":"2026-11-02T15:46:46.760785Z"},{"id":"MGASA-2015-0392","title":"Updated jakarta-commons-httpclient and httpcomponents-client packages fixes security vulnerability","description":"The Apache httpclient library had a bug where the socket timeout was\nignored during the SSL handshake, causing threads in an application to\nhang (CVE-2015-5262).\n","status":"published","published":"2015-10-09T18:47:39Z","modified":"2026-04-16T06:22:23.364049449Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"openSUSE-SU-2020:1873-1","title":"Security update for apache-commons-httpclient","description":"This update for apache-commons-httpclient fixes the following issues:\n\n- http/conn/ssl/SSLConnectionSocketFactory.java ignores the\n  http.socket.timeout configuration setting during an SSL handshake,\n  which allows remote attackers to cause a denial of service (HTTPS\n  call hang) via unspecified vectors. [bsc#945190, CVE-2015-5262]\n- org.apache.http.conn.ssl.AbstractVerifier does not properly\n  verify that the server hostname matches a domain name in the\n  subject's Common Name (CN) or subjectAltName field of the X.509\n  certificate, which allows MITM attackers to spoof SSL servers\n  via a 'CN=' string in a field in the distinguished name (DN)\n  of a certificate. [bsc#1178171, CVE-2014-3577]\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2020-11-07T13:24:32Z","modified":"2026-02-04T02:53:33.933486Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"openSUSE-SU-2020:1875-1","title":"Security update for apache-commons-httpclient","description":"This update for apache-commons-httpclient fixes the following issues:\n\n- http/conn/ssl/SSLConnectionSocketFactory.java ignores the\n    http.socket.timeout configuration setting during an SSL handshake,\n    which allows remote attackers to cause a denial of service (HTTPS\n    call hang) via unspecified vectors. [bsc#945190, CVE-2015-5262]\n- org.apache.http.conn.ssl.AbstractVerifier does not properly\n    verify that the server hostname matches a domain name in the\n    subject's Common Name (CN) or subjectAltName field of the X.509\n    certificate, which allows MITM attackers to spoof SSL servers\n    via a 'CN=' string in a field in the distinguished name (DN)\n    of a certificate. [bsc#1178171, CVE-2014-3577]\n\nThis update was imported from the SUSE:SLE-15-SP2:Update update project.","status":"published","published":"2020-11-08T05:26:16Z","modified":"2026-02-04T03:29:20.300558Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"openSUSE-SU-2024:10621-1","title":"apache-commons-httpclient-3.1-13.4 on GA media","description":"These are all security issues fixed in the apache-commons-httpclient-3.1-13.4 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:14:52.775654Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2020:3149-1","title":"Security update for apache-commons-httpclient","description":"This update for apache-commons-httpclient fixes the following issues:\n\n- http/conn/ssl/SSLConnectionSocketFactory.java ignores the\n  http.socket.timeout configuration setting during an SSL handshake,\n  which allows remote attackers to cause a denial of service (HTTPS\n  call hang) via unspecified vectors. [bsc#945190, CVE-2015-5262]\n- org.apache.http.conn.ssl.AbstractVerifier does not properly\n  verify that the server hostname matches a domain name in the\n  subject's Common Name (CN) or subjectAltName field of the X.509\n  certificate, which allows MITM attackers to spoof SSL servers\n  via a 'CN=' string in a field in the distinguished name (DN)\n  of a certificate. [bsc#1178171, CVE-2014-3577]\n","status":"published","published":"2020-11-04T10:05:07Z","modified":"2025-05-02T04:04:05.475474Z","updated_at":"2026-11-02T15:53:48.11786Z"},{"id":"SUSE-SU-2020:3151-1","title":"Security update for apache-commons-httpclient","description":"This update for apache-commons-httpclient fixes the following issues:\n\n- http/conn/ssl/SSLConnectionSocketFactory.java ignores the\n  http.socket.timeout configuration setting during an SSL handshake,\n  which allows remote attackers to cause a denial of service (HTTPS\n  call hang) via unspecified vectors. [bsc#945190, CVE-2015-5262]\n- org.apache.http.conn.ssl.AbstractVerifier does not properly\n  verify that the server hostname matches a domain name in the\n  subject's Common Name (CN) or subjectAltName field of the X.509\n  certificate, which allows MITM attackers to spoof SSL servers\n  via a 'CN=' string in a field in the distinguished name (DN)\n  of a certificate. [bsc#1178171, CVE-2014-3577]\n","status":"published","published":"2020-11-04T10:06:34Z","modified":"2026-02-04T04:35:00.683998Z","updated_at":"2026-11-02T15:53:48.11786Z"},{"id":"SUSE-SU-2020:3152-1","title":"Security update for apache-commons-httpclient","description":"This update for apache-commons-httpclient fixes the following issues:\n\n- http/conn/ssl/SSLConnectionSocketFactory.java ignores the\n    http.socket.timeout configuration setting during an SSL handshake,\n    which allows remote attackers to cause a denial of service (HTTPS\n    call hang) via unspecified vectors. [bsc#945190, CVE-2015-5262]\n- org.apache.http.conn.ssl.AbstractVerifier does not properly\n    verify that the server hostname matches a domain name in the\n    subject's Common Name (CN) or subjectAltName field of the X.509\n    certificate, which allows MITM attackers to spoof SSL servers\n    via a 'CN=' string in a field in the distinguished name (DN)\n    of a certificate. [bsc#1178171, CVE-2014-3577]\n","status":"published","published":"2020-11-04T10:07:13Z","modified":"2026-02-04T02:34:11.511909Z","updated_at":"2026-11-02T15:53:48.11786Z"},{"id":"UBUNTU-CVE-2015-5262","description":"http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the http.socket.timeout configuration setting during an SSL handshake, which allows remote attackers to cause a denial of service (HTTPS call hang) via unspecified vectors.","status":"published","published":"2015-09-30T00:00:00Z","modified":"2026-02-04T04:14:58.416914Z","updated_at":"2026-11-02T15:54:10.385269Z"},{"id":"USN-2769-1","title":"commons-httpclient vulnerabilities","description":"It was discovered that Apache Commons HttpClient did not properly verify the\nCommon Name or subjectAltName fields of X.509 certificates. An attacker could\nexploit this to perform a machine-in-the-middle attack to view sensitive\ninformation or alter encrypted communications. This issue only affected Ubuntu\n12.04 LTS. (CVE-2012-5783)\n\nFlorian Weimer discovered the fix for CVE-2012-5783 was incomplete for Apache\nCommons HttpClient. An attacker could exploit this to perform a\nmachine-in-the-middle attack to view sensitive information or alter\nencrypted communications. This issue only affected Ubuntu 12.04 LTS.\n(CVE-2012-6153)\n\nSubodh Iyengar and Will Shackleton discovered the fix for CVE-2012-5783 was\nincomplete for Apache Commons HttpClient. An attacker could exploit this to\nperform a machine-in-the-middle attack to view sensitive information or alter\nencrypted communications. (CVE-2014-3577)\n\nIt was discovered that Apache Commons HttpClient did not properly handle read\ntimeouts during HTTPS handshakes. A remote attacker could trigger this flaw to\ncause a denial of service. (CVE-2015-5262)\n","status":"published","published":"2015-10-14T15:43:52Z","modified":"2026-02-10T04:40:55Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}