What’s Vulnerable › Products

Apache Software Foundation Apache HttpClient vulnerabilities

10 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 4 published in the last 12 months.

Check whether your Apache Software Foundation Apache HttpClient version is affected

Latest Apache Software Foundation Apache HttpClient vulnerabilities

• CVE-2026-71290 — Apache HttpComponents Client: TLS hostname verification silently disabled on the async transport (default config, MITM) (CVSS 9.1)
• CVE-2026-64607 — Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS (CVSS 5.3)
• CVE-2026-40542 — Apache HttpClient: SCRAM-SHA-256 mutual authentication bypass may cause the client to accept authentication without proper mutual authentication verification (CVSS 7.3)
• CVE-2025-27820 — Apache HttpComponents: PSL (Public Suffix List) validation bypass (CVSS 7.5)
• CVE-2020-13956 — (CVSS 5.3)
• CVE-2013-4366 — (CVSS 9.8)
• CVE-2015-5262 — (CVSS 4.3)
• CVE-2014-3577 — (CVSS 5.8)
• CVE-2012-5783 — (CVSS 5.8)
• CVE-2011-1498 — (CVSS 4.3)