This advisory highlights a significant operational vulnerability in using Java's native HTTP client for scenarios requiring robust timeout mechanisms, such as web crawling. Moving to Apache's HttpClient introduced challenges with resource management and connection closing, leading to potential service interruptions.
The issue revolves around the use of Java's built-in HTTP client for web crawling purposes. The lack of socket timeouts and improper handling of connection pooling resources in Apache's HttpClient lead to crawler stalls.
Action Items:
- Implement custom timeout mechanisms for socket reads when using Java’s built-in HTTP client.
- Ensure proper resource management and connection closure handling in Apache's HttpClient implementations, particularly addressing the SO_LINGER socket option.