HT
Product
Httpclient
10
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 2High 2Medium 2Low 0
Watch
Add Httpclient to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2013-4366 | 9.8 | Oct 30 | http/impl/client/HttpClientBuilder.java in Apache HttpClient 4.3.x before 4.3.1 does not ensure that X509HostnameVerifier is not null, which allows attackers to have unspecified… Affected: 4.3; 4.3; 4.3; 4.3 |
| CVE-2026-71290 | 9.1 | Aug 11 | Apache HttpComponents Client: TLS hostname verification silently disabled on the async transport (default config, MITM) Affected: 5.4 before 5.6.4 |
| CVE-2025-27820 | 7.5 | Apr 24 | A bug in PSL validation logic in Apache HttpClient 5.4.x disables domain checks, affecting cookie management and host name verification Affected: 5.4 before 5.4.3 |
| CVE-2026-40542 | 7.3 | Apr 22 | Apache HttpClient: SCRAM-SHA-256 mutual authentication bypass may cause the client to accept authentication without proper mutual authentication verification Affected: 5.6 |
| CVE-2026-64607 | 5.3 | Jul 31 | Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS Affected: 5.0.0 before 5.6.3 |
| CVE-2020-13956 | 5.3 | Dec 2 | Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick… Affected: before 4.5.13; 5.0.0 before 5.0.3 |
| CVE-2015-5262 | – | Oct 27 | http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the http.socket.timeout configuration setting during an SSL handshake, which… Affected: 4.3 through 4.3.5 |
| CVE-2014-3577 | – | Aug 21 | org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname… Affected: 4.0 through 4.3.4 |
| CVE-2012-5783 | – | Nov 4 | Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server hostname matches a domain… Affected: 3.1 |
| CVE-2011-1498 | – | Jul 7 | Apache HttpClient 4.x before 4.1.1 in Apache HttpComponents, when used with an authenticating proxy server, sends the Proxy-Authorization header to the origin server, which allows… Affected: 4.0; 4.0; 4.0; 4.0; 4.0; 4.0; +6 more |
Showing 10