-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the RequestProxyAuthentication class's process method handling proxy authentication headers. The commit diff shows a critical addition of a route.isTunnelled() check to prevent Proxy-Authorization headers from being sent to the origin server during tunneling. Before this fix, the absence of this check allowed the header to leak. The function's responsibility for proxy authentication logic and the explicit patch to add tunneling validation directly correlate to the vulnerability description.
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.httpcomponents:httpclient | maven | >= 4.0.0, < 4.1.1 | 4.1.1 |
Ongoing coverage of React2Shell