CVE-2017-14063

Name of the Vulnerable Software and Affected Versions Async Http Client versions prior to 2.0.35

Description The issue allows Async Http Client to be tricked into connecting to a host different from the one extracted by java.net.URI if a '?' character occurs in a fragment identifier. This is similar to previously identified bugs in cURL and Oracle Java 8 java.net.URL.

Recommendations For versions prior to 2.0.35, update to version 2.0.35 or later to resolve the issue.