Httpclient (Apache) - vulnerabilities (CVEs)
10 CVEs, 0 in the last 30 days, 98 known versions, newest CVE from 2026-08-11. Vendor: Apache.
CVEs of Httpclient
- CVE-2026-71290 - CVSS 9.1 (critical), 2026-08-11: Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicy#BUILTIN setting has no effect when…
- CVE-2026-64607 - CVSS 5.3 (medium), 2026-07-31: HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or…
- CVE-2026-40542 - CVSS 7.3 (high), 2026-04-22: Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper…
- CVE-2025-27820 - CVSS 7.5 (high), 2025-04-24: A bug in PSL validation logic in Apache HttpClient 5.4.x disables domain checks, affecting cookie management and host name verification. Discovered by the…
- CVE-2020-13956 - CVSS 5.3 (medium), 2020-12-02: Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as…
- CVE-2013-4366 - CVSS 9.8 (critical), 2017-10-30: http/impl/client/HttpClientBuilder.java in Apache HttpClient 4.3.x before 4.3.1 does not ensure that X509HostnameVerifier is not null, which allows attackers…
- CVE-2015-5262 - CVSS 4.3 (medium), 2015-10-27: http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the http.socket.timeout configuration setting during an…
- CVE-2014-3577 - CVSS 5.8 (medium), 2014-08-21: org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the…
- CVE-2012-5783 - CVSS 5.8 (medium), 2012-11-04: Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server…
- CVE-2011-1498 - CVSS 4.3 (medium), 2011-07-07: Apache HttpClient 4.x before 4.1.1 in Apache HttpComponents, when used with an authenticating proxy server, sends the Proxy-Authorization header to the origin…
