CVE-2017-14063 – Async Http Client versions before 2.0.35 contai... (How to Fix)

Q: What is the severity of CVE-2017-14063?

CVE-2017-14063 has a CVSS score of 7.5 (HIGH). Async Http Client versions before 2.0.35 contain a URI parsing vulnerability where a '?' character in a fragment identifier can trick the client into connecting to a different host than intended. This affects applications using vulnerable versions of the async-http-client library for HTTP requests. Similar vulnerabilities were previously found in cURL and Java 8.

📋 TL;DR

Async Http Client versions before 2.0.35 contain a URI parsing vulnerability where a '?' character in a fragment identifier can trick the client into connecting to a different host than intended. This affects applications using vulnerable versions of the async-http-client library for HTTP requests. Similar vulnerabilities were previously found in cURL and Java 8.

💻 Affected Systems

Products:

Async Http Client (async-http-client)

Versions: All versions before 2.0.35

Operating Systems: All platforms running Java

Default Config Vulnerable: ⚠️ Yes

Notes: Affects any Java application using vulnerable async-http-client versions to make HTTP requests, particularly when processing untrusted URLs.

📦 What is this software?

Async Http Client by Asynchttpclient Project

View all CVEs affecting Async Http Client →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers could redirect HTTP requests to malicious servers, potentially leading to credential theft, data exfiltration, or server-side request forgery (SSRF) attacks.

🟠

Likely Case

HTTP request manipulation allowing redirection to attacker-controlled servers, potentially intercepting sensitive data or performing unauthorized actions.

🟢

If Mitigated

Limited impact if proper input validation and URL sanitization are implemented, or if affected systems don't process untrusted URLs.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires the application to process attacker-controlled URLs. Similar vulnerabilities in cURL and Java were actively exploited.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 2.0.35 and later

Vendor Advisory: https://github.com/AsyncHttpClient/async-http-client/issues/1455

Restart Required: Yes

Instructions:

1. Update async-http-client dependency to version 2.0.35 or later. 2. Update pom.xml or build.gradle to specify the fixed version. 3. Rebuild and redeploy the application. 4. Restart any running services using the library.

🔧 Temporary Workarounds

Input validation and sanitization

all

Implement strict validation and sanitization of all URLs before passing them to async-http-client, rejecting URLs with '?' in fragment identifiers.

Network restrictions

all

Implement outbound firewall rules to restrict HTTP connections to trusted destinations only.

🧯 If You Can't Patch

Implement strict input validation to reject URLs with '?' characters in fragment identifiers before processing
Use network segmentation and egress filtering to limit outbound HTTP connections to authorized destinations only

🔍 How to Verify

Check if Vulnerable:

Check the async-http-client version in your project dependencies. If using Maven: mvn dependency:tree | grep async-http-client. If using Gradle: gradle dependencies | grep async-http-client.

Check Version:

mvn dependency:tree | grep async-http-client || gradle dependencies | grep async-http-client

Verify Fix Applied:

After updating, verify the version is 2.0.35 or later using the same commands. Test with sample URLs containing '?' in fragments to ensure proper parsing.

📡 Detection & Monitoring

Log Indicators:

Unexpected outbound HTTP connections to unknown domains
HTTP requests with unusual URL structures containing '?' in fragments

Network Indicators:

HTTP traffic to unexpected destinations from applications using async-http-client
Unusual redirect patterns in HTTP traffic

SIEM Query:

source="application_logs" AND ("async-http-client" OR "AHC") AND (url CONTAINS "?#" OR url CONTAINS "%3F%23")

📊 Metadata

CVE ID: CVE-2017-14063

CVSS v3 Score: 7.5 (HIGH)

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CWE: CWE-20

Published: August 31, 2017

Last Updated: April 20, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2017-14063, you might also want to check these: