CVE-2026-40542

all versions

Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 au

7.3HIGH

CVE-2025-27820

>= 5.4 and < 5.4.3

A bug in PSL validation logic in Apache HttpClient 5.4.x disables domain checks, affecting cookie management and host name verific

7.5HIGH

CVE-2024-50342

< 5.4.46

symfony/http-client is a module for the Symphony PHP framework which provides powerful methods to fetch HTTP resources synchronous

3.1LOW

CVE-2020-13956

< 4.5.13

Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed

5.3MEDIUM

CVE-2020-15094

>= 4.4.0 and < 4.4.13

In Symfony before versions 4.4.13 and 5.1.5, the CachingHttpClient class from the HttpClient Symfony component relies on the HttpC

8.0HIGH

CVE-2020-11021

< 1.0.8

Actions Http-Client (NPM @actions/http-client) before version 1.0.8 can disclose Authorization headers to incorrect domain in cert

6.3MEDIUM

CVE-2013-4366

all versions

http/impl/client/HttpClientBuilder.java in Apache HttpClient 4.3.x before 4.3.1 does not ensure that X509HostnameVerifier is not n

9.8CRITICAL

CVE-2016-6287

<= 0.9

The "http-client" egg always used a HTTP_PROXY environment variable to determine whether HTTP traffic should be routed via a proxy

7.5HIGH

CVE-2016-6286

<= 0.4.2

The "spiffy-cgi-handlers" egg would convert a nonexistent "Proxy" header to the HTTP_PROXY environment variable, which would allow

7.5HIGH

CVE-2015-5262

>= 4.3 and <= 4.3.5

http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the http.socket.timeout con

CVE-2014-3577

>= 4.0 and <= 4.3.4

org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does n

CVE-2012-5783

all versions

Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not ve

CVE-2011-1498

all versions

Apache HttpClient 4.x before 4.1.1 in Apache HttpComponents, when used with an authenticating proxy server, sends the Proxy-Author