CVE-2015-5262

CVE-2015-5262 is a medium-severity vulnerability in Apache Httpclient with a CVSS 2.0 base score of 4.3. Its EPSS exploit-prediction score of 19% places it in the 97th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-399.

Key facts

Description

http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the http.socket.timeout configuration setting during an SSL handshake, which allows remote attackers to cause a denial of service (HTTPS call hang) via unspecified vectors.

Frequently asked questions

What is CVE-2015-5262?
http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the http.socket.timeout configuration setting during an SSL handshake, which allows remote attackers to cause a denial of service (HTTPS call hang) via unspecified vectors.
How severe is CVE-2015-5262?
CVE-2015-5262 has a CVSS 2.0 base score of 4.3, rated medium severity.
Is CVE-2015-5262 being actively exploited?
It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 19% (97th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2015-5262?
CVE-2015-5262 primarily affects Apache Httpclient. In total, 7 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2015-5262?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2015-5262 published?
CVE-2015-5262 was published on 2015-10-27 and last updated on 2026-06-17.

References

Affected products (7)

More vulnerabilities in Apache Httpclient

All CVEs affecting Apache Httpclient →

Other CWE-399 (Resource Management Errors) vulnerabilities

Browse all CWE-399 (Resource Management Errors) vulnerabilities →