CVE-2020-13956: apache httpclient Improper Input Validation

Modified

AliasesMGASA-2021-0314SUSE-SU-2024:4036-1RHSA-2022:0722+335 more

Published 02-12-2020Last modified 08-10-2026

Vulnerability summary

CVE-2020-13956 is a medium (CVSS 5.3) Improper Input Validation vulnerability in apache httpclient. EPSS estimates a 9.03% chance of exploitation in the next 30 days, higher than 95.2% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 5.3, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

5.3/10

010

Medium · v3.1 (CVE.org)

EPSS score

9.03%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 4 · Related 4

OPENSUSE-SU-2024:10687-1 RHSA-2021:0246 RHSA-2021:0247 RHSA-2021:0248 CGA-6936-26RM-54QH CGA-7V36-X4W2-722Q+1 more

Timeline

02-12-2020
PublishedVulnerability first disclosed.
08-10-2026
Last modifiedVulnerability information updated.

Description

Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.

CVSS metrics

9 scores · 8 sources · 2 versions

v3.15.3v2.05.0

EPSS trend

Probability

9.03%

Chance of exploitation in the next 30 days

Percentile

95%

Versus all other CVEs

30-day change

No change 0.00 pp

From 9.03% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard149 products

druidAll versions (No fix recorded) | < 35.0.1-r1
eco-java-gradle-1.11All versions (No fix recorded)
eco-java-gradle-2.0All versions (No fix recorded)
eco-java-gradle-2.1All versions (No fix recorded)
eco-java-gradle-2.10All versions (No fix recorded)

eco-java-gradle-2.11All versions (No fix recorded)
eco-java-gradle-2.12All versions (No fix recorded)
eco-java-gradle-2.13All versions (No fix recorded)
eco-java-gradle-2.14All versions (No fix recorded)
eco-java-gradle-2.14.1All versions (No fix recorded)
eco-java-gradle-2.2All versions (No fix recorded)
eco-java-gradle-2.2.1All versions (No fix recorded)
eco-java-gradle-2.3All versions (No fix recorded)
eco-java-gradle-2.4All versions (No fix recorded)
eco-java-gradle-2.5All versions (No fix recorded)
eco-java-gradle-2.6All versions (No fix recorded)
eco-java-gradle-2.7All versions (No fix recorded)
eco-java-gradle-2.8All versions (No fix recorded)
eco-java-gradle-2.9All versions (No fix recorded)
eco-java-gradle-3.0All versions (No fix recorded)
eco-java-gradle-3.1All versions (No fix recorded)
eco-java-gradle-3.2All versions (No fix recorded)
eco-java-gradle-3.2.1All versions (No fix recorded)
eco-java-gradle-3.3All versions (No fix recorded)
eco-java-gradle-3.4All versions (No fix recorded)
eco-java-gradle-3.4.1All versions (No fix recorded)
eco-java-gradle-3.5All versions (No fix recorded)
eco-java-gradle-3.5.1All versions (No fix recorded)
eco-java-gradle-4.0All versions (No fix recorded)
eco-java-gradle-4.0.1All versions (No fix recorded)
eco-java-gradle-4.0.2All versions (No fix recorded)
eco-java-gradle-4.1All versions (No fix recorded)
eco-java-gradle-4.10All versions (No fix recorded)
eco-java-gradle-4.10.1All versions (No fix recorded)
eco-java-gradle-4.10.2All versions (No fix recorded)
eco-java-gradle-4.10.3All versions (No fix recorded)
eco-java-gradle-4.2All versions (No fix recorded)
eco-java-gradle-4.2.1All versions (No fix recorded)
eco-java-gradle-4.3All versions (No fix recorded)
eco-java-gradle-4.3.1All versions (No fix recorded)
eco-java-gradle-4.4All versions (No fix recorded)
eco-java-gradle-4.4.1All versions (No fix recorded)
eco-java-gradle-4.5All versions (No fix recorded)
eco-java-gradle-4.5.1All versions (No fix recorded)
eco-java-gradle-4.6All versions (No fix recorded)
eco-java-gradle-4.7All versions (No fix recorded)
eco-java-gradle-4.8All versions (No fix recorded)
eco-java-gradle-4.8.1All versions (No fix recorded)
eco-java-gradle-4.9All versions (No fix recorded)
eco-java-gradle-5.0All versions (No fix recorded)
eco-java-gradle-5.1All versions (No fix recorded)
eco-java-gradle-5.1.1All versions (No fix recorded)
eco-java-gradle-5.2All versions (No fix recorded)
eco-java-gradle-5.2.1All versions (No fix recorded)
eco-java-gradle-5.3All versions (No fix recorded)
eco-java-gradle-5.3.1All versions (No fix recorded)
eco-java-gradle-5.4All versions (No fix recorded)
eco-java-gradle-5.4.1All versions (No fix recorded)
eco-java-gradle-5.5All versions (No fix recorded)
eco-java-gradle-5.5.1All versions (No fix recorded)
eco-java-gradle-5.6All versions (No fix recorded)
eco-java-gradle-5.6.1All versions (No fix recorded)
eco-java-gradle-5.6.2All versions (No fix recorded)
eco-java-gradle-5.6.3All versions (No fix recorded)
eco-java-gradle-5.6.4All versions (No fix recorded)
eco-java-gradle-6.0All versions (No fix recorded)
eco-java-gradle-6.0.1All versions (No fix recorded)
eco-java-gradle-6.1All versions (No fix recorded)
eco-java-gradle-6.1.1All versions (No fix recorded)
eco-java-gradle-6.2All versions (No fix recorded)
eco-java-gradle-6.2.1All versions (No fix recorded)
eco-java-gradle-6.2.2All versions (No fix recorded)
eco-java-gradle-6.3All versions (No fix recorded)
eco-java-gradle-6.4All versions (No fix recorded)
eco-java-gradle-6.4.1All versions (No fix recorded)
eco-java-gradle-6.5All versions (No fix recorded)
eco-java-gradle-6.5.1All versions (No fix recorded)
eco-java-gradle-6.6All versions (No fix recorded)
eco-java-gradle-6.6.1All versions (No fix recorded)
eco-java-gradle-6.7All versions (No fix recorded)
eco-java-gradle-6.7.1All versions (No fix recorded)
eco-java-gradle-6.8All versions (No fix recorded)
eco-java-gradle-6.8.1All versions (No fix recorded)
eco-java-gradle-6.8.2All versions (No fix recorded)
eco-java-gradle-6.8.3All versions (No fix recorded)
elasticsearch-7< 7.17.14-r2
hadoop-fips-3.3.6All versions (No fix recorded)
hadoop-fips-3.4.2All versions (No fix recorded)
hadoop-fips-3.5All versions (No fix recorded)
trino< 440-r0
trino-config< 440-r0
trino-oci-entrypoint< 440-r0
trino-plugin-ai-functions< 440-r0
trino-plugin-bigquery< 440-r0
trino-plugin-blackhole< 440-r0
trino-plugin-cassandra< 440-r0
trino-plugin-clickhouse< 440-r0
trino-plugin-delta-lake< 440-r0
trino-plugin-druid< 440-r0
trino-plugin-duckdb< 440-r0
trino-plugin-elasticsearch< 440-r0
trino-plugin-exasol< 440-r0
trino-plugin-exchange-filesystem< 440-r0
trino-plugin-exchange-hdfs< 440-r0
trino-plugin-faker< 440-r0
trino-plugin-functions-python< 440-r0
trino-plugin-geospatial< 440-r0
trino-plugin-google-sheets< 440-r0
trino-plugin-hive< 440-r0
trino-plugin-http-event-listener< 440-r0
trino-plugin-http-server-event-listener< 440-r0
trino-plugin-hudi< 440-r0
trino-plugin-iceberg< 440-r0
trino-plugin-ignite< 440-r0
trino-plugin-jmx< 440-r0
trino-plugin-kafka< 440-r0
trino-plugin-kafka-event-listener< 440-r0
trino-plugin-lakehouse< 440-r0
trino-plugin-ldap-group-provider< 440-r0
trino-plugin-loki< 440-r0
trino-plugin-mariadb< 440-r0
trino-plugin-memory< 440-r0
trino-plugin-ml< 440-r0
trino-plugin-mongodb< 440-r0
trino-plugin-mysql< 440-r0
trino-plugin-mysql-event-listener< 440-r0
trino-plugin-opa< 440-r0
trino-plugin-openlineage< 440-r0
trino-plugin-opensearch< 440-r0
trino-plugin-oracle< 440-r0
trino-plugin-password-authenticators< 440-r0
trino-plugin-pinot< 440-r0
trino-plugin-postgresql< 440-r0
trino-plugin-prometheus< 440-r0
trino-plugin-ranger< 440-r0
trino-plugin-redis< 440-r0
trino-plugin-redshift< 440-r0
trino-plugin-resource-group-managers< 440-r0
trino-plugin-session-property-managers< 440-r0
trino-plugin-singlestore< 440-r0
trino-plugin-snowflake< 440-r0
trino-plugin-spooling-filesystem< 440-r0
trino-plugin-sqlserver< 440-r0
trino-plugin-teradata-functions< 440-r0
trino-plugin-thrift< 440-r0
trino-plugin-tpcds< 440-r0
trino-plugin-tpch< 440-r0
trino-plugin-vertica< 440-r0
zaproxy< 2.17.0-r10

Show all 149

Wolfi50 products

druidAll versions (No fix recorded) | < 35.0.1-r1
trino< 440-r0
trino-config< 440-r0
trino-oci-entrypoint< 440-r0
trino-plugin-ai-functions< 440-r0

Show all 50

Apache1 product

httpclient< 4.5.13 | ≥ 5.0.0, < 5.0.3

3 vendors · 200 products · Showing 200 of 296

References

146 links

lists.apache.org/thread.html/…X Refsource MISCAdvisoryWEBMailing ListVendor Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB

Show all 100 references

lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
www.oracle.com/security-alerts/cpuApr2021.htmlX Refsource MISCFIXWEBPatchThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
www.oracle.com//security-alerts/cpujul2021.htmlX Refsource MISCFIXWEBPatchThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
www.oracle.com/security-alerts/cpuoct2021.htmlX Refsource MISCFIXWEBPatchThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
www.oracle.com/security-alerts/cpujan2022.htmlX Refsource MISCAdvisoryWEBThird Party Advisory
www.oracle.com/security-alerts/cpuapr2022.htmlX Refsource MISCFIXWEBPatchThird Party Advisory
security.netapp.com/advisory/ntap-20220210-0002/X Refsource CONFIRMAdvisoryThird Party Advisory
priyankn.github.io/2021-02-26-CVE-2020-13956/WEB
advisories.mageia.org/MGASA-2021-0314.htmlAdvisory
bugs.mageia.org/show_bug.cgi?id=27389REPORT
www.debian.org/security/2020/dsa-4772WEB
www.suse.com/support/update/announcement/2024/suse-su-20244036-1/Advisory
bugzilla.suse.com/1177488REPORT
www.suse.com/security/cve/CVE-2020-13956WEB
access.redhat.com/errata/RHSA-2022:0722Advisory
access.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=1886587REPORT
security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0722.jsonAdvisory
access.redhat.com/security/cve/CVE-2020-13956REPORT
www.cve.org/CVERecord?id=CVE-2020-13956AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2020-13956Advisory
www.openwall.com/lists/oss-security/2020/10/08/4ARTICLE
access.redhat.com/errata/RHSA-2022:1860Advisory
access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.6_release_notes/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=1991521REPORT
security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1860.jsonAdvisory
access.redhat.com/errata/RHSA-2022:1861Advisory
security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1861.jsonAdvisory
ubuntu.com/security/CVE-2020-13956REPORT
ubuntu.com/security/notices/USN-5239-1Advisory
security-tracker.debian.org/tracker/CVE-2020-13956Advisory
lists.opensuse.org/archives/…Advisory
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB

Showing 100 of 146.