CVE-2020-13956

CVE-2020-13956 affects Apache HttpClient prior to 4.5.13 and 5.0.3. A malformed authority component in request URIs, when passed as a java.net.URI, can cause the client to misinterpret the target host and execute the request against an unintended host. This represents a misrouting vulnerability i...

CVE-2012-5783

Apache Commons HttpClient 3.x (as used in Amazon FPS Java SDK and related products) is affected by CVE-2012-5783: the code does not verify that the server hostname matches the CN/subjectAltName in the X.509 certificate, enabling potential MITM spoofing with arbitrary certificates. AIX advisories,...

CVE-2026-71290

Apache HttpComponents Client 5.4 and newer contains an improper TLS hostname verification vulnerability (CWE-295) in the async version of HttpClient. The root cause is that the HostnameVerificationPolicy#BUILTIN setting has no effect, allowing a network attacker to intercept traffic and impersona...

CVE-2025-27820

A bug in the PSL validation logic within Apache HttpClient 5.4.x disables domain checks , which impacts cookie management and host name verification . This vulnerability was discovered by the Apache HttpClient team and has been addressed in the 5.4.3 release . No specific exploit details or in-th...

CVE-2014-3577

CVE-2014-3577 (Apache HttpComponents) . The vulnerability affects Apache HttpClient prior to 4.3.5 and HttpAsyncClient prior to 4.0.2 where hostname verification against the certificate’s CN or subjectAltName can fail due to an incomplete/incorrect check, enabling man-in-the-middle attackers to s...

CVE-2026-64607

The Apache HttpComponents Client (versions 5.0-alpha1 through 5.6.2) contains a resource leak vulnerability (CWE-772 ) where the HttpClient based on the classic i/o model fails to release underlying connections back to the connection manager when encountering invalid or unsupported Content-Encodi...

CVE-2015-5262

CVE-2015-5262 affects Apache HttpComponents HttpClient prior to 4.3.6 where the http.socket.timeout setting is ignored during SSL handshakes, enabling potential DoS via HTTPS call hangs. IBM-connected docs reference this CVE in IBM StreamSets Data Collector 6.4.0 with a fixed release path, noting...

CVE-2011-1498

CVE-2011-1498 : Apache HttpClient (HttpComponents) 4.x release before 4.1.1 is vulnerable when used with an authenticating proxy; the Proxy-Authorization header is sent to the origin server, potentially logging sensitive credentials and exposing passwords. The description does not specify affecte...

CVE-2013-4366

CVE-2013-4366 concerns http/impl/client/HttpClientBuilder.java in Apache HttpClient 4.3.x before 4.3.1, where the code does not ensure that the X509HostnameVerifier is non-null. This can allow attackers to trigger unspecified impact via vectors involving hostname verification. Connected documents...

CVE-2026-40542

A missing critical step in the authentication process of Apache HttpClient 5.6 allows an attacker to bypass proper mutual authentication verification during SCRAM-SHA-256 authentication. This vulnerability affects several products, including IBM App Connect Enterprise (v13.0.1.0 - 13.0.7.2), Mong...