CVE-2013-4366

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-10-30 · updated 2026-06-16
Weakness: CWE-20

Description

http/impl/client/HttpClientBuilder.java in Apache HttpClient 4.3.x before 4.3.1 does not ensure that X509HostnameVerifier is not null, which allows attackers to have unspecified impact via vectors involving hostname verification.

Affected products

Apache Software Foundation Apache HttpClient: 4.3, 4.3-alpha1, 4.3-beta1, 4.3-beta2

References

http://svn.apache.org/r1528614
http://www.apache.org/dist/httpcomponents/httpclient/RELEASE_NOTES-4.3.x.txt
http://svn.apache.org/r1528614
http://www.apache.org/dist/httpcomponents/httpclient/RELEASE_NOTES-4.3.x.txt

Get alerted when CVE-2013-4366 or the next vulnerability affects your stack