CVE-2015-5262: Denial of Service Vulnerability in org.apache.httpcomponents:httpclient
Summary
CVE-2015-5262: Denial of service vulnerability in org.apache.httpcomponents:httpclient. Affects org.apache.httpcomponents:httpclient versions < 4.3.6. Fixed in 4.3.6. How to fix ↓
Also tracked for
- commons-httpclient · Debian:11
The same CVE-2015-5262 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The org.apache.httpcomponents:httpclient package is a widely used library for making HTTP requests in Java applications. It provides functionality for sending HTTP requests, handling responses, and managing connections. This vulnerability affects versions prior to 4.3.6 of the package. The package is vulnerable to a denial of service attack during an SSL handshake, where the http.socket.timeout configuration setting is ignored. This allows remote attackers to cause a hang in HTTPS calls, resulting in a denial of service.
Vulnerability Detail
The vulnerability originates from the SSLConnectionSocketFactory class in the package. It fails to consider the http.socket.timeout configuration setting when performing an SSL handshake. This oversight enables attackers to exploit the vulnerability by sending specially crafted requests that trigger a hang in HTTPS calls. The exact vectors for exploitation are unspecified. The impact of this vulnerability is a denial of service, where affected applications become unresponsive due to the hanging HTTPS calls.
How To Fix
Latest published version: 4.5.14 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.3.6
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The org.apache.httpcomponents:httpclient package is vulnerable to a denial of service attack due to a flaw in the SSLConnectionSocketFactory class. Upgrading to version 4.3.6 or later of the package is recommended to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.httpcomponents:httpclient →
FAQ
The impact of this vulnerability is a denial of service, where affected applications become unresponsive due to hanging HTTPS calls.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your pom.xml file and the playground will analyze it for open-source vulnerabilities in real-time.
Yes, upgrading the org.apache.httpcomponents:httpclient package to version 4.3.6 or later will fix this vulnerability.
The exact vectors for exploitation are unspecified, but remote attackers can trigger the vulnerability by sending specially crafted requests.
There is no specific workaround mentioned for this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.httpcomponents:httpclient.
