Login Request a demo
Unscored severity · published Jul 7, 2011
CVE-2011-1498
Apache HttpClient 4.x before 4.1.1 in Apache HttpComponents, when used with an authenticating proxy server, sends the Proxy-Authorization header to the origin server, which allows…
–
CVSS
6.7%
EPSS
No
On KEV
Description
Apache HttpClient 4.x before 4.1.1 in Apache HttpComponents, when used with an authenticating proxy server, sends the Proxy-Authorization header to the origin server, which allows remote web servers to obtain sensitive information by logging this header.
Exploitation
Is it being used?
Exploit prediction (EPSS)6.7% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HT
Httpclient · Apache
4.0; 4.0; 4.0; 4.0; 4.0; 4.0; +6 more · source: NVD
Affected product
HT
Httpclient
Apache
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-1498
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-1498
lists.fedoraproject.org
http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061440.html
marc.info
http://marc.info/?l=httpclient-users&m=129853896315461&w=2
marc.info
http://marc.info/?l=httpclient-users&m=129856318011586&w=2
marc.info
http://marc.info/?l=httpclient-users&m=129857589129183&w=2
marc.info
http://marc.info/?l=httpclient-users&m=129858274406594&w=2
marc.info
http://marc.info/?l=httpclient-users&m=129858299106950&w=2
More from Httpclient
9.8
CVE-2013-4366
http/impl/client/HttpClientBuilder.java in Apache HttpClient 4.3.x before 4.3.1 does not ensure that X509HostnameVerifier is not null, which allows attackers to have unspecified…
9.1
CVE-2026-71290
Apache HttpComponents Client: TLS hostname verification silently disabled on the async transport (default config, MITM)
7.5
CVE-2025-27820
A bug in PSL validation logic in Apache HttpClient 5.4.x disables domain checks, affecting cookie management and host name verification
7.3
CVE-2026-40542
Apache HttpClient: SCRAM-SHA-256 mutual authentication bypass may cause the client to accept authentication without proper mutual authentication verification
5.3
CVE-2026-64607
Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS