CVE Feed

    Dashboard / CVE / CVE-2015-5262

    CVE-2015-5262

    http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the http.socket.timeout configuration setting during an SSL handshake, which allows remote attackers to cause a denial of service (HTTPS call hang) via unspecified vectors.

    Published:Sep 3, 2015
    Last Modified:Apr 12, 2025
    EPS:Oct 27, 2015
    EPSS Score:0.00949
    CVSS Score:4.3

    Affected Products

    Vendor
    Apache
    Product
    Httpclient
    Vendor
    Canonical
    Product
    Ubuntu Linux
    Vendor
    Fedoraproject
    Product
    Fedora

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-71290 (CVSS 9.1) — Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerific…
    CVE-2026-64607 (CVSS 5.3) — HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the con…
    CVE-2026-40542 (CVSS 7.3) — Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to acc…
    CVE-2025-27820 (CVSS 7.5) — A bug in PSL validation logic in Apache HttpClient 5.4.x disables domain checks, affecting cookie management a…
    CVE-2020-13956 (CVSS 5.3) — Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in…
    CVE-2013-4366 (CVSS 9.8) — http/impl/client/HttpClientBuilder.java in Apache HttpClient 4.3.x before 4.3.1 does not ensure that X509Hostn…
    CVE-2014-3577 (CVSS 5.8) — org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient…
    CVE-2012-5783 (CVSS 5.8) — Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other p…
    CVE-2011-1498 (CVSS 4.3) — Apache HttpClient 4.x before 4.1.1 in Apache HttpComponents, when used with an authenticating proxy server, se…

    References

    http://lists.fedoraproject.org/pipermail/package-announce/2015-October/167962.html
    http://lists.fedoraproject.org/pipermail/package-announce/2015-October/167999.html
    http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168030.html
    http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00032.html
    http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00033.html
    http://svn.apache.org/viewvc?view=revision&revision=1626784
    http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
    http://www.securitytracker.com/id/1033743
    http://www.ubuntu.com/usn/USN-2769-1
    https://bugzilla.redhat.com/show_bug.cgi?id=1261538
    https://issues.apache.org/jira/browse/HTTPCLIENT-1478
    https://jenkins.io/security/advisory/2018-02-26/
    https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E
    https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E
    https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E
    http://lists.fedoraproject.org/pipermail/package-announce/2015-October/167962.html
    http://lists.fedoraproject.org/pipermail/package-announce/2015-October/167999.html
    http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168030.html
    http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00032.html
    http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00033.html
    http://svn.apache.org/viewvc?view=revision&revision=1626784
    http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
    http://www.securitytracker.com/id/1033743
    http://www.ubuntu.com/usn/USN-2769-1
    https://bugzilla.redhat.com/show_bug.cgi?id=1261538
    https://issues.apache.org/jira/browse/HTTPCLIENT-1478
    https://jenkins.io/security/advisory/2018-02-26/
    https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E
    https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E
    https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High