CVE-2022-22885

CRITICAL

Hutool v5.7.18's HttpRequest was discovered to ignore all TLS/SSL certificate validation.

Affects 1 product across 1 vendor.

CVSS 3.19.8
EPSS1.3%
Percentile70th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-295: CWE-295
Related Attack Patterns (CAPEC)
CAPEC-459 Creating a Rogue Certification Authority Certificate
via CWE-295
CAPEC-475 Signature Spoofing by Improper Validation
via CWE-295

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

Hutool v5.7.18's HttpRequest component is vulnerable to man-in-the-middle attacks due to the lack of TLS/SSL certificate validation.

BSID: BS-2022-GLOBAL-312971-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2022-22885?
Hutool v5.7.18's HttpRequest component is vulnerable to man-in-the-middle attacks due to the lack of TLS/SSL certificate validation.
What is the CVSS score for CVE-2022-22885?
CVE-2022-22885 has CVSS 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS: 1.3%.
Is CVE-2022-22885 actively exploited?
No confirmed active exploitation of CVE-2022-22885 as of 2026-05-30.
How do I remediate CVE-2022-22885?
Priority: IMMEDIATE.
What systems are affected by CVE-2022-22885?
CVE-2022-22885 affects Hutool Hutool.
Vulnerability Details
CVE IDCVE-2022-22885
BSIDBS-2022-GLOBAL-312971-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published2022-02-16
Last Modified2024-11-21
ICS Relevance0%
Weakness (CWE)
CWE-295
SourceNVD
Official Description

Hutool v5.7.18's HttpRequest was discovered to ignore all TLS/SSL certificate validation.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

An attacker could intercept and modify traffic between the application using Hutool's HttpRequest and the intended server, as the application does not validate the server's SSL certificate.

Exploitation Likelihood: CRITICAL

Affected Products
VendorProductAffected Versions
Hutool Hutool 5.7.18
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 1702 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hash65619e906bc9c01fc76aeb7c67fa0c12ed561a7837a79f487ee67833f20d94cfbaa6ea6c4a3949e7f7651b0d1fbe5a03656e8abc646678515537bad9e355ed23
Related CVEs affecting Hutool
CVE-2023-42276 9.8 hutool v5.8.21 was discovered to contain a buffer overflow via the component ... CVE-2023-42277 9.8 hutool v5.8.21 was discovered to contain a buffer overflow via the component ... CVE-2023-24162 9.8 Deserialization vulnerability in Dromara Hutool v5.8.11 allows attacker to ex... CVE-2023-24163 9.8 SQL Inection vulnerability in Dromara hutool before 5.8.21 allows attacker to... CVE-2022-45689 7.5 hutool-json v5.8.10 was discovered to contain an out of memory error.
View all Hutool CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.8 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →