What is CVE-2017-14063?

CVE-2017-14063 is a high-severity vulnerability in Asynchttpclient Project Async-Http-Client, classified under Improper Input Validation. CVSS score: 7.5/10. Published 2017-08-31.

How severe is CVE-2017-14063?

High severity. CVSS v3 base score is 7.5 out of 10.

Improper input validation in Asynchttpclient Project Async-Http-Client

CVE-2017-14063

Async Http Client (aka async-http-client) before 2.0.35 can be tricked into connecting to a host different from the one extracted by java.net.URI if a '?' character occurs in a fragment identifier. Similar bugs were previously identified in cURL (CVE-2016-8624) and Oracle Java 8 java.net.URL.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

Published 2017-08-31 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.

EPSS exploit prediction

EPSS: 0.030 (87.0th percentile), scored 2026-09-30.

Low probability of exploitation in the next 30 days, but still tracked. 87th percentile — 87.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.030 · newest: 0.030 · change: 0.000

Affected products

Asynchttpclient Project Async-Http-Client

Weakness classification (CWE)

CWE-20 — Improper Input Validation

References

github.com/AsyncHttpClient/async-http-client/issues/1455 (Patch, Third Party Advisory, Issue Tracking)
access.redhat.com/errata/RHSA-2018:2669 (vendor-advisory, Third Party Advisory)
openwall.com/lists/oss-security/2017/08/31/4 (Patch, Mailing List, Third Party Advisory)
lists.apache.org/thread.html/rfaa4d578587f52a9c4d176af516a681a712c664e3be440a41… (mailing-list)
lists.apache.org/thread.html/r79d9bab405414af45568c4683386f5e9fd02c10ca87ffa2ee… (mailing-list)
lists.apache.org/thread.html/re2510852c4a1f635b14b35e5dfd7597076928e723ab08559e… (mailing-list)
lists.apache.org/thread.html/r04b15fd898a6b1612153543375daaa8145a0fd1804ec9fa2e… (mailing-list)
lists.apache.org/thread.html/rcb46acc25917e01ebecca132e870da9ab935d5796686ed8a2… (mailing-list)
lists.apache.org/thread.html/r7046a51116207588e36ca8c2e291327e391dae40712d26711… (mailing-list)
lists.apache.org/thread.html/r7879a48644f708be0529bd39f0679ad3ad951f3dc24442878… (mailing-list)

Frequently asked questions

What is CVE-2017-14063?: CVE-2017-14063 is a high-severity vulnerability in Asynchttpclient Project Async-Http-Client, classified under Improper Input Validation. CVSS score: 7.5/10. Published 2017-08-31.
How severe is CVE-2017-14063?: High severity. CVSS v3 base score is 7.5 out of 10.