CVE-2015-5262 Denial of service vulnerability in org.apache.httpcomponents:httpclient
Remote attackers can cause a denial of service by hanging HTTPS calls due to ignored socket timeouts during SSL handshakes in Apache HttpComponents HttpClient.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2015-5262?
CVE-2015-5262 is a medium-severity denial of service vulnerability in Canonical Ubuntu Linux, published on 27 Oct 2015. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the http.socket.timeout configuration setting during an SSL handshake, which allows remote attackers to cause a denial of service (HTTPS call hang) via unspecified vectors.
Weakness: CWE-399
Which versions are affected by CVE-2015-5262?
2 open source packages ship an affected version, including org.apache.httpcomponents:httpclient. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.httpcomponents:httpclient Maven | All versions | 4.3.6 |
org.apache.httpcomponents:httpclient Maven | All versions | 4.3.6 |
Products include Apache Httpclient, Canonical Ubuntu Linux, Fedoraproject Fedora.
How do I fix CVE-2015-5262?
Upgrade org.apache.httpcomponents:httpclient to 4.3.6 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2015-5262 being exploited?
There is no known exploitation of CVE-2015-5262 in the wild and no public exploit code.
Other vulnerabilities in Canonical Ubuntu Linux
- CVE-2013-4366 Hostname verification in Apache HttpClient 4.3 was disabled by default
- CVE-2026-71290 Apache HttpComponents Client: TLS hostname verification silently disabled on the async transport (default config, MITM)
- CVE-2025-27820 Apache HttpComponents: PSL (Public Suffix List) validation bypass
- CVE-2026-40542 Apache HttpClient accepts SCRAM-SHA-256 authentication without proper mutual authentication verification
- CVE-2012-5783 Improper Certificate Validation in Apache Commons HttpClient
Sources
Also known as CLSA-2026-1791370172, CLSA-2026-1791898676, DEBIAN-CVE-2015-5262, DLA-322-1, GHSA-fmj5-wv96-r2ch, MGASA-2015-0392 and 1 more.