Httpclient
Approved changes feed: RSS · Atom
cpe:2.3:a:apache:httpclient:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Apache (b0303047-b7dd-5cf8-abcc-71b7d9d80b95) |
|---|---|
| Product | Httpclient (5178236a-ae38-5806-9e41-5f4089bffd33) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:apache/hc |
purl2cpe | 2026-06-01 10:14:28.603690 |
pkg:github/apache/httpcomponents-client |
purl2cpe | 2026-06-01 10:14:28.603692 |
pkg:maven/org.apache.httpcomponents/httpclient |
purl2cpe | 2026-06-01 10:14:28.603693 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-27820 |
vulnerable | 2026-06-08 07:14:55.760588 |
Apache HttpComponents: PSL (Public Suffix List) validation bypass
A bug in PSL validation logic in Apache HttpClient 5.4.x disables domain checks, affecting cookie management and host name verification. Discovered by the Apache HttpClient team. Fixed in the 5.4.3 release
Published: 2025-04-24T11:44:25.986Z
Updated: 2025-06-04T11:20:12.764Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-13956 |
vulnerable | 2026-06-08 05:18:01.614284 |
Details available
Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.
Published: 2020-12-02T16:20:12.000Z
Updated: 2025-12-01T15:45:49.435Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2015-5262 |
vulnerable | 2026-06-08 05:06:49.378502 |
Details available
http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the http.socket.timeout configuration setting during an SSL handshake, which allows remote attackers to cause a denial of service (HTTPS call hang) via unspecified vectors.
Published: 2015-10-27T16:00:00.000Z
Updated: 2024-08-06T06:41:09.189Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2014-3577 |
vulnerable | 2026-06-08 05:05:33.571445 |
Details available
org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a "CN=" string in a field in the distinguished name (DN) of a certificate, as demonstrated by the "foo,CN=www.apache.org" string in the O field.
Published: 2014-08-21T00:00:00.000Z
Updated: 2024-08-06T10:50:17.592Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.