CVE-2020-13956
MediumCVSS 5.3Exploitation Probability (EPSS)
Very high risk95th percentile - higher than 95% of all known CVEs
Summary
Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.
Risk Assessment
Incorrect target host selection could lead to sending requests to unexpected servers, potentially resulting in data exposure or SSRF attacks.
Recommendation
It is recommended to upgrade Apache HttpClient to version 4.5.13 or 5.0.3 or later, and validate URIs before passing them to the library.
Other vulnerabilities in Apache HttpClient
See all- CVE-2013-4366Critical
In Apache HttpClient versions 4.3.x before 4.3.1, it does not ensure that X509HostnameVerifier is not null, which may allow attackers to exploit vulnerabilities involving hostname verification.
- CVE-2026-40542High
In Apache HttpClient 5.6, a missing critical step in authentication allows an attacker to force the client to accept SCRAM-SHA-256 authentication without proper mutual authentication verification. The issue is fixed in version 5.6.1.
Original NVD description (English source)
Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS