Skip to content
Fencer Vulns
medium 5.3

CVE-2020-13956 json

Cross-site scripting in Apache HttpClient

published 2020-12-02 5 y ago modified 2026-10-08 31 d ago also GHSA-7r82-7xv7-xcpj , EUVD-2021-1284

cvss
5.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
9.0%
EPSS 9.0% chance of exploitation in 30 days, percentile 95%
public exploits
0
none known

Summary

Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.

Patch / fix

  • maven org.apache.httpcomponents:httpclient 4.5.13, 5.0.3
  • apache httpclient 4.5.13, 5.0.3
  • quarkus quarkus 1.7.6
  • oracle jd_edwards_enterpriseone_orchestrator 9.2.6.0
  • oracle jd_edwards_enterpriseone_tools 9.2.6.0
  • oracle nosql_database 20.3
  • oracle spatial_studio 20.1.1
  • oracle sql_developer 20.4.1.407.0006, 21.99
  • httpcomponents-client Debian 14, Debian 13, Debian 12 4.5.13-1

debian advisories DEBIAN-CVE-2020-13956

  • httpcomponents-client Ubuntu Pro 14.04 LTS 4.3.3-1ubuntu0.1+esm2
  • httpcomponents-client Ubuntu Pro 16.04 LTS 4.5.1-1ubuntu0.1~esm1
  • httpcomponents-client Ubuntu Pro 18.04 LTS 4.5.5-1ubuntu0.1~esm1
  • httpcomponents-client Ubuntu Pro 20.04 LTS 4.5.11-1ubuntu0.1~esm1

ubuntu advisories UBUNTU-CVE-2020-13956

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • sisu RHEL 8 1:0.3.3-6.module+el8+2452+b359bfcd
  • jansi RHEL 8 1.17.1-1.module+el8+2452+b359bfcd
  • jsoup RHEL 8 1.11.3-3.module+el8+2452+b359bfcd
  • maven RHEL 8 1:3.5.4-5.module+el8+2452+b359bfcd
  • slf4j RHEL 8 1.7.25-4.module+el8+2452+b359bfcd
  • cdi-api RHEL 8 1.2-8.module+el8+2452+b359bfcd
  • guava20 RHEL 8 20.0-8.module+el8+2452+b359bfcd
  • hawtjni RHEL 8 1.16-2.module+el8+2452+b359bfcd

red hat advisories RHSA-2022:1861RHSA-2022:1860RHSA-2022:0722RHSA-2021:0248RHSA-2021:0247RHSA-2021:0246

  • httpcomponents-core SLE Module for Development Tools 15 SP6, SLE Module for Development Tools 15 SP5, openSUSE Leap 15.6 +2 more 4.4.14-150200.3.9.1
  • httpcomponents-client SLE Module for Development Tools 15 SP6, SLE Module for Development Tools 15 SP5, openSUSE Leap 15.6 +2 more 4.5.14-150200.3.9.1

suse advisories SUSE-SU-2024:4036-1

  • httpcomponents-client openSUSE Tumbleweed 4.5.14-1.1
  • clojure openSUSE Tumbleweed 1.10.3.855-1.2

opensuse advisories openSUSE-SU-2024:14478-1openSUSE-SU-2024:10687-1

  • jansi AlmaLinux 8 1.17.1-1.module_el8.6.0+2752+f1f3449e
  • jansi AlmaLinux 8 1.17.1-1.module_el8.0.0+6044+f3cbc35d
  • jansi AlmaLinux 8 1.17.1-1.module_el8.4.0+2250+516cbbff
  • jsoup AlmaLinux 8 1.11.3-3.module_el8.6.0+2752+f1f3449e
  • maven AlmaLinux 8 1:3.5.4-5.module_el8.6.0+2752+f1f3449e
  • slf4j AlmaLinux 8 1.7.25-4.module_el8.6.0+2752+f1f3449e
  • slf4j AlmaLinux 8 1.7.25-4.module_el8.5.0+2577+9e95fe00
  • cdi-api AlmaLinux 8 1.2-8.module_el8.6.0+2752+f1f3449e

almalinux advisories ALSA-2022:1861ALSA-2022:1860

  • sisu Rocky Linux 8 1:0.3.3-6.module+el8.6.0+843+5a13dac3
  • sisu Rocky Linux 8 1:0.3.3-6.module+el8.3.0+74+855e3f5d
  • sisu Rocky Linux 8 1:0.3.3-6.module+el8.3.0+133+b8b54b58
  • jansi Rocky Linux 8 1.17.1-1.module+el8.3.0+241+f23502a8
  • jansi Rocky Linux 8 1.17.1-1.module+el8.3.0+74+855e3f5d
  • jansi Rocky Linux 8 1.17.1-1.module+el8.3.0+133+b8b54b58
  • jsoup Rocky Linux 8 1.11.3-3.module+el8.6.0+843+5a13dac3
  • jsoup Rocky Linux 8 1.11.3-3.module+el8.3.0+74+855e3f5d

rocky linux advisories RLSA-2022:1861RLSA-2022:1860

  • maven Arch Linux 3.8.1-1

arch linux advisories AVG-1863

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-13956 updated cvss 5.3

apache-httpclient: incorrect handling of malformed authority component in request URIs

  • Red Hat BPM Suite 6 httpclient
    affected: no fix planned “Out of support scope”
  • Red Hat build of OpenJDK 1.8 redhat-openjdk-18/openjdk18-openshift redhat-openjdk-18/openjdk18-openshift Red Hat build of OpenJDK 11 openjdk/openjdk-11-rhel7 openjdk/openjdk-11-rhel7
    affected: no fix available
  • Red Hat Enterprise Linux 7 httpcomponents-client, httpcomponents-client-javadoc
    affected: no fix planned “Will not fix”
  • Red Hat JBoss A-MQ 6 httpclient Red Hat JBoss BRMS 5 httpclient Red Hat JBoss BRMS 6 httpclient Red Hat JBoss Data Grid 7 httpclient Red Hat JBoss Data Virtualization 6 httpclient Red Hat JBoss Enterprise Application Platform 5 httpclient
    +4 more products
    Red Hat JBoss Enterprise Application Platform 6 httpclient Red Hat JBoss Fuse 6 httpclient Red Hat JBoss Fuse Service Works 6 httpclient Red Hat JBoss Operations Network 3 httpclient
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Container Platform 3.11 openshift3/ose-logging-elasticsearch5
    affected: no fix available “Fix deferred”
  • Red Hat OpenShift Container Platform 4 openshift4/ose-metering-hive, openshift4/ose-metering-hadoop, openshift4/ose-metering-presto, openshift4/ose-logging-elasticsearch5
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat Software Collections rh-maven35-httpcomponents-client, rh-maven35-httpcomponents-client-cache, rh-maven35-httpcomponents-client-javadoc
    affected: no fix planned “Out of support scope”
  • Red Hat streams for Apache Kafka httpclient
    affected: no fix available
show 16 more
  • Red Hat AMQ 7.9.0
    fixed: vendor fix RHSA-2021:3700
  • Red Hat build of Quarkus 1.7.6
    fixed: vendor fix RHSA-2021:0084
  • Red Hat Enterprise Linux AppStream (v. 8) sisu 0.3.3-6.module+el8+2452+b359bfcd, cdi-api 1.2-8.module+el8+2452+b359bfcd, maven 3.5.4-5.module+el8+2452+b359bfcd, guava20 20.0-8.module+el8+2452+b359bfcd, hawtjni 1.16-2.module+el8+2452+b359bfcd, jansi 1.17.1-1.module+el8+2452+b359bfcd, +75 more
    fixed: vendor fix RHSA-2022:1861
  • Red Hat Fuse 7.9
    fixed: vendor fix RHSA-2021:3140
  • Red Hat Fuse 7.12
    fixed: vendor fix RHSA-2023:3954
  • Red Hat Integration - Camel K - Tech-Preview 3
    fixed: vendor fix RHSA-2021:0811
  • Red Hat JBoss EAP 7.3 for BaseOS-8 eap7-wildfly 7.3.5-2.GA_redhat_00001.1.el8eap, eap7-undertow 2.0.33-1.SP2_redhat_00001.1.el8eap, eap7-narayana 5.9.10-1.Final_redhat_00001.1.el8eap, eap7-resteasy 3.11.3-1.Final_redhat_00001.1.el8eap, eap7-activemq-artemis 2.9.0-7.redhat_00017.1.el8eap, eap7-hibernate 5.3.20-1.Final_redhat_00001.1.el8eap, +90 more
    fixed: vendor fix RHSA-2021:0248
  • Red Hat JBoss EAP 7.3 for RHEL 6 Server eap7-wildfly 7.3.5-2.GA_redhat_00001.1.el6eap, eap7-undertow 2.0.33-1.SP2_redhat_00001.1.el6eap, eap7-narayana 5.9.10-1.Final_redhat_00001.1.el6eap, eap7-resteasy 3.11.3-1.Final_redhat_00001.1.el6eap, eap7-activemq-artemis 2.9.0-7.redhat_00017.1.el6eap, eap7-hibernate 5.3.20-1.Final_redhat_00001.1.el6eap, +90 more
    fixed: vendor fix RHSA-2021:0246
  • Red Hat JBoss EAP 7.3 for RHEL 7 Server eap7-wildfly 7.3.5-2.GA_redhat_00001.1.el7eap, eap7-undertow 2.0.33-1.SP2_redhat_00001.1.el7eap, eap7-narayana 5.9.10-1.Final_redhat_00001.1.el7eap, eap7-resteasy 3.11.3-1.Final_redhat_00001.1.el7eap, eap7-activemq-artemis 2.9.0-7.redhat_00017.1.el7eap, eap7-hibernate 5.3.20-1.Final_redhat_00001.1.el7eap, +92 more
    fixed: vendor fix RHSA-2021:0247
  • Red Hat JBoss Enterprise Application Platform 7
    fixed: vendor fix RHSA-2021:0250
  • Red Hat Single Sign-On 7.4.5
    fixed: vendor fix RHSA-2021:0327
  • Red Hat Software Collections for RHEL Workstation(v. 7) rh-maven36-httpcomponents-client 4.5.9-1.3.el7, rh-maven36-httpcomponents-client-javadoc 4.5.9-1.3.el7 Red Hat Software Collections for RHEL(v. 7) rh-maven36-httpcomponents-client 4.5.9-1.3.el7, rh-maven36-httpcomponents-client-javadoc 4.5.9-1.3.el7
    fixed: vendor fix RHSA-2022:0722
  • Red Hat RHDM 7.10.0
    fixed: vendor fix RHSA-2021:0603
  • Red Hat RHINT Service Registry 2.0.2 GA
    fixed: vendor fix RHSA-2021:4100
  • Red Hat RHPAM 7.10.1
    fixed: vendor fix RHSA-2021:1044
  • Red Hat Enterprise Linux 9 httpcomponents-client, httpcomponents-client-javadoc Red Hat Integration Service Registry httpclient Red Hat OpenShift Container Platform 4 openshift4/ose-logging-elasticsearch6
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
31 d ago

Exploit prediction

9.03% chance of exploitation in the next 30 days, higher than 95% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
NVD 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CNA 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:N/I:P/A:N
GitHub 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Affected packages

ecosystem package affected fixed in
maven org.apache.httpcomponents:httpclient
<4.5.13
>=5.0.0, <5.0.3
4.5.13
5.0.3

Affected products

  • n/a Apache HttpClient

Classification

Weakness
  • CWE-20 Improper Input Validation
  • CWE-79 Improper Neutralization of Input During Web Page Generation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.