vetkit.resilience.http-call-without-timeout.java-httpclient
HttpClient.newHttpClient() creates a client without a connect timeout, and its requests have no response timeout unless each HttpRequest sets one, so an unresponsive server blocks the caller indefinitely.
Last updated:
Suite: Production readiness
java
HttpClient.newHttpClient() creates a client without a connect timeout, and its requests have no response timeout unless each HttpRequest sets one, so an unresponsive server blocks the caller indefinitely.
Category: RESILIENCE · Engine rule severity: INFO
How to fix it
Build the client with HttpClient.newBuilder().connectTimeout(Duration.ofSeconds(5)).build() and set .timeout(...) on each HttpRequest.Builder.
Rule pattern example
The engine’s matching pattern, not a confirmed exploit. Metavariables and ellipses describe matching syntax.
HttpClient.newHttpClient()References
Source: packages/engine/rules/resilience/java.yml.
Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.