CVE-2017-14063: Improper Input Validation in async-http-client
Summary
CVE-2017-14063: Improper Input Validation in async-http-client. Affects org.asynchttpclient:async-http-client versions < 2.0.35. Fixed in 2.0.35. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Async Http Client (aka async-http-client) is a popular Java library used for making asynchronous HTTP requests. It provides a simple and efficient way to send HTTP requests and handle responses asynchronously. The library is widely used in various applications and frameworks to perform HTTP communication. However, versions before 2.0.35 are vulnerable to an improper input validation issue.
Vulnerability Detail
The vulnerability in async-http-client arises from a flaw in the way it handles URI parsing. If a '?' character occurs in the fragment identifier of a URI, the library can be tricked into connecting to a different host than intended. This can lead to various security issues, such as connecting to a malicious server or leaking sensitive information to an unintended recipient. Similar vulnerabilities have been identified in cURL and Oracle Java 8 java.net.URL in the past.
How To Fix
Latest published version: 3.0.14 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.0.35
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented by manually validating the URI before passing it to async-http-client. This can be done by checking for the presence of a '?' character in the fragment identifier and rejecting the URI if found. Here's an example of how this can be done in Java:
URI uri = new URI(url);
if (uri.getFragment() != null && uri.getFragment().contains("?")) {
// Handle or reject the URI
}
Implementing this workaround will help mitigate the vulnerability until the library can be updated.
Conclusion
The improper input validation vulnerability in async-http-client can be mitigated by upgrading to version 2.0.35 or later. It is important to promptly update the library to ensure the security of applications that rely on async-http-client for HTTP communication. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.asynchttpclient:async-http-client →
FAQ
Async Http Client is a Java library used for making asynchronous HTTP requests. It provides a simple and efficient way to send HTTP requests and handle responses asynchronously.
The vulnerability allows an attacker to trick async-http-client into connecting to a different host than intended. This can lead to various security issues, such as connecting to a malicious server or leaking sensitive information.
No, only versions before 2.0.35 are affected by this vulnerability. It is recommended to upgrade to the latest version to mitigate the risk.
There is no information available regarding exploitation of this specific vulnerability in the wild. However, it is always recommended to apply security patches and updates to prevent potential attacks.
More information about the fix for this vulnerability can be found in the official GitHub advisory: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-93jq-624g-4p9p/GHSA-93jq-624g-4p9p.json
Related vulnerabilities
Recent vulnerabilities recorded for org.asynchttpclient:async-http-client.
