Package · Maven

org.apache.httpcomponents.client5:httpclient5

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

High 7.3

CVE-2026-40542

Apache HttpClient: SCRAM-SHA-256 mutual authentication bypass may cause the client to accept authentication without proper mutual authentication verification

Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper mutual authentication verification. Users are recommended to upgrade to version 5.6.1, which fixes th…

Apache Software Foundation Apache HttpClient httpcomponents-client org.apache.httpcomponents.client5:httpclient5 Ubuntu Maven

Apr 22, 2026
High 7.5

CVE-2025-27820

Apache HttpComponents: PSL (Public Suffix List) validation bypass

A bug in PSL validation logic in Apache HttpClient 5.4.x disables domain checks, affecting cookie management and host name verification. Discovered by the Apache HttpClient team. Fixed in the 5.4.3 release

Apache Software Foundation Apache HttpComponents httpcomponents-client org.apache.httpcomponents.client5:httpclient5 Ubuntu Maven

Apr 24, 2025