Hostname verification in Apache HttpClient 4.3 was disabled by default

CRITICAL 9.8CVE-2013-4366 · GHSA-pqwh-44jj-p5rm · Published 30/10/2017 · updated 16/06/2026

Package	Affected versions	Patched versions
org.apache.httpcomponents:httpclient Maven	`≥ 4.3, < 4.3.1`	`4.3.1`
httpclient apache	`= 4.3`	No fix yet

Description

http/impl/client/HttpClientBuilder.java in Apache HttpClient 4.3.x before 4.3.1 does not ensure that X509HostnameVerifier is not null, which allows attackers to have unspecified impact via vectors involving hostname verification.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2013-4366 · ADVISORY
apache/httpcomponents-client commit 0814086 · WEB
svn.apache.org/r1528614 · WEB
apache.org/dist/httpcomponents/httpclient/RELEASE_NOTES-4.3.x.txt · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free