CVE-2013-4366
CriticalSummary
In Apache HttpClient versions 4.3.x before 4.3.1, it does not ensure that X509HostnameVerifier is not null, which may allow attackers to exploit vulnerabilities involving hostname verification.
Risk Assessment
The lack of proper hostname verification may lead to man-in-the-middle attacks, jeopardizing the integrity and confidentiality of data transmitted by the application.
Recommendation
It is recommended to upgrade Apache HttpClient to version 4.3.1 or later to ensure proper hostname verification.
Other vulnerabilities in Apache HttpClient
See all- CVE-2020-13956Medium
Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.
- CVE-2026-40542High
In Apache HttpClient 5.6, a missing critical step in authentication allows an attacker to force the client to accept SCRAM-SHA-256 authentication without proper mutual authentication verification. The issue is fixed in version 5.6.1.
Original NVD description (English source)
http/impl/client/HttpClientBuilder.java in Apache HttpClient 4.3.x before 4.3.1 does not ensure that X509HostnameVerifier is not null, which allows attackers to have unspecified impact via vectors involving hostname verification.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS