CVE-2013-4366

CRITICAL

Apache HttpClient 4.3.x < 4.3.1 - Improper Input Validation in HttpClientBuilder

Title source: llm

Description

http/impl/client/HttpClientBuilder.java in Apache HttpClient 4.3.x before 4.3.1 does not ensure that X509HostnameVerifier is not null, which allows attackers to have unspecified impact via vectors involving hostname verification.

References (2)

Core 2

Core References

Issue Tracking, Patch, Release Notes, Vendor Advisory x_refsource_confirm

http://svn.apache.org/r1528614

Issue Tracking, Release Notes, Vendor Advisory x_refsource_confirm

http://www.apache.org/dist/httpcomponents/httpclient/RELEASE_NOTES-4.3.x.txt

Scores

CVSS v3 9.8

EPSS 0.0129

EPSS Percentile 80.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-20

Status published

Products (2)

apache/httpclient 4.3 (4 CPE variants)

org.apache.httpcomponents/httpclient 4.3 - 4.3.1Maven

Published Oct 30, 2017

Tracked Since Feb 18, 2026