# org.apache.httpcomponents:httpclient (Maven) vulnerabilities

6 known vulnerabilities (1 medium), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://central.sonatype.com/artifact/org.apache.httpcomponents/httpclient

## Advisories (6)

### [CVE-2020-13956](https://cve.now/CVE-2020-13956): Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the li

- Severity: Medium 5.3
- Published: Dec 2, 2020
- Affected: fixed in 4.5.13; from 5.0.0, fixed in 5.0.3.

### [CVE-2013-4366](https://cve.now/CVE-2013-4366): http/impl/client/HttpClientBuilder.java in Apache HttpClient 4.3.x before 4.3.1 does not ensure that X509HostnameVerifier is not null…

- Severity: Unrated
- Published: Oct 30, 2017
- Affected: from 4.3, fixed in 4.3.1.

### [CVE-2015-5262](https://cve.now/CVE-2015-5262): http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the http.socket.timeout…

- Severity: Unrated
- Published: Oct 27, 2015
- Affected: fixed in 4.3.6.

### [CVE-2012-6153](https://cve.now/CVE-2012-6153): http/conn/ssl/AbstractVerifier.java in Apache Commons HttpClient before 4.2.3 does not properly verify that the server hostname matches a…

- Severity: Unrated
- Published: Sep 4, 2014
- Affected: fixed in 4.2.3.

### [CVE-2014-3577](https://cve.now/CVE-2014-3577): org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not…

- Severity: Unrated
- Published: Aug 21, 2014
- Affected: fixed in 4.3.5.

### [CVE-2011-1498](https://cve.now/CVE-2011-1498): Apache HttpClient 4.x before 4.1.1 in Apache HttpComponents, when used with an authenticating proxy server, sends the Proxy-Authorization…

- Severity: Unrated
- Published: Jul 7, 2011
- Affected: from 4.0.0, fixed in 4.1.1.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/maven/org.apache.httpcomponents:httpclient
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.