Unscored severity · published Oct 27, 2015
CVE-2015-5262
http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the http.socket.timeout configuration setting during an SSL handshake, which…
–
CVSS
18.8%
EPSS
No
On KEV
Description
http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the http.socket.timeout configuration setting during an SSL handshake, which allows remote attackers to cause a denial of service (HTTPS call hang) via unspecified vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)18.8% · higher than 97% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FE
Fedora · Fedoraproject
21; 22; 23 · source: NVD
HT
Httpclient · Apache
4.3 through 4.3.5 · source: NVD
UL
Ubuntu Linux · Canonical
12.04; 14.04; 15.04 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-5262
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-5262
Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-October/167962.html
Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-October/167999.html
Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168030.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00032.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00033.html
Vendor Advisory
http://svn.apache.org/viewvc?view=revision&revision=1626784
More from Httpclient
9.8
CVE-2013-4366
http/impl/client/HttpClientBuilder.java in Apache HttpClient 4.3.x before 4.3.1 does not ensure that X509HostnameVerifier is not null, which allows attackers to have unspecified…
9.1
CVE-2026-71290
Apache HttpComponents Client: TLS hostname verification silently disabled on the async transport (default config, MITM)
7.5
CVE-2025-27820
A bug in PSL validation logic in Apache HttpClient 5.4.x disables domain checks, affecting cookie management and host name verification
7.3
CVE-2026-40542
Apache HttpClient: SCRAM-SHA-256 mutual authentication bypass may cause the client to accept authentication without proper mutual authentication verification
5.3
CVE-2026-64607
Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS