CVE-2020-13956

Aliases:GHSA-7r82-7xv7-xcpjDEBIAN-CVE-2020-13956CGA-257w-3grm-w48cCGA-2g35-gcph-cwh8CGA-2gmp-mvc4-5x76CGA-2h4c-v8xm-v574CGA-2j38-cprq-m2wwCGA-2m75-hjf9-v6w5CGA-2mg7-gqm4-f66hCGA-2pg4-jfcp-77crCGA-2qq7-j48q-743mCGA-2xch-chg6-q87wCGA-32rp-5g24-hcw9CGA-3cmx-pp66-rw7vCGA-3jg2-wcp8-8r52CGA-3q56-c9mq-8387CGA-3q6w-9rr8-2559CGA-422m-jqvr-p5g8CGA-4364-6hq3-qm93CGA-43gp-mw5p-f6gxCGA-47f6-r62v-4mq3CGA-487w-mj4h-xg87CGA-49hp-m335-v7mrCGA-4jjf-h76v-rj3fCGA-4px3-26hc-3rm8CGA-4r2c-82h4-hxwjCGA-4x88-9xp8-hqggCGA-5c4p-crvg-wvc5CGA-5cf8-4w58-7jrvCGA-5g33-9hm8-cv7mCGA-5r8j-qx59-2j4qCGA-65rv-cgfm-pc9pCGA-65xf-fxw2-583rCGA-68f4-7h8r-rw2jCGA-68vc-9qgg-4c98CGA-69wp-f69v-x834CGA-6rhg-fmpw-4mfrCGA-6vf3-p52j-cqhmCGA-7666-4vp5-4594CGA-79g4-mrxv-63w4CGA-7mmp-4762-7w88CGA-7r7v-mg33-fwq2CGA-7w6q-xwx8-fcj4CGA-838g-523w-m2x4CGA-8jwj-cfmc-8f7rCGA-8r3p-vx36-f84pCGA-8r7v-vc58-rcv9CGA-8rgc-6jjh-jmmfCGA-8wmx-p6m7-4qx4CGA-8xg2-68jm-76rqCGA-9347-qp5r-8qp2CGA-95g7-5c87-xj7jCGA-97m3-xg5r-qwh8CGA-9ccv-94f8-gf86CGA-9rx4-65mj-853qCGA-c354-j6qm-9fwfCGA-c3p4-6h3v-jhq2CGA-c68r-37h5-5c75CGA-chmq-cj5p-w45wCGA-cp97-685m-924vCGA-cvch-fx3q-fhgpCGA-cwgx-rhff-c7wpCGA-f43c-gh8m-43mpCGA-f58j-w495-8pp3CGA-f7ph-j43p-jhfrCGA-g5cj-27fc-365fCGA-gc2v-97gw-3cm4CGA-gcmr-mmr9-58pjCGA-gg7r-cfcr-w9xqCGA-gm5x-rcfm-mwp2CGA-gr8m-4v69-5979CGA-hfqj-ff7g-7jrqCGA-hjv9-2w42-9mchCGA-hpxr-9p9w-pxm6CGA-hvch-2wpr-492wCGA-hxvg-w87v-8v6vCGA-j3jv-33v9-v8x3CGA-jrxh-3pcj-8xq8CGA-m732-7w66-2fjjCGA-m7r4-qcxh-p4x7CGA-m8g4-qp6h-894qCGA-m9fv-6v9p-64hqCGA-m9j9-5cwh-vr9gCGA-mfgv-876p-m5qvCGA-mvj3-frr8-vqfhCGA-mvx9-6q8x-rg6xCGA-p35j-939v-2w5gCGA-p3q7-4mpv-pp3wCGA-p52f-5xqg-74mxCGA-p53p-w9f3-wjvwCGA-pgfp-9pmh-8mv5CGA-ph5j-qrf6-x82pCGA-pqpv-33xm-gg72CGA-2542-x67j-rp77CGA-264j-44rg-g8x4CGA-2gpp-9m44-r26rCGA-2r7r-p942-cmgfCGA-3622-38cr-f99hCGA-433h-hgfr-4c4cCGA-49cx-h48w-qc8vCGA-4x4g-r37q-qw45CGA-5mcc-jfh8-pvf7CGA-6fqf-w263-rw2fCGA-6fvm-w7m2-69h7CGA-6rvv-5996-q83xCGA-7cj6-q7fj-qqchCGA-7gcc-fjmw-6qgxCGA-7wpq-4c3p-7j32CGA-8223-fpx3-hh2cCGA-859m-fmh2-qw2qCGA-9987-w693-5c28CGA-9x33-99xv-3f7wCGA-c23h-w8j4-69r6CGA-c5wm-x657-j627CGA-c726-gh5x-q92pCGA-c7g3-g2cx-27xjCGA-c932-77jg-j72pCGA-cm77-69hh-4c6wCGA-crhr-w96q-ccvmCGA-f3hf-5xwh-98q4CGA-f484-gw55-m8wwCGA-fpvx-vjc6-59w5CGA-g4gg-j62j-p784CGA-g895-pm88-gj95CGA-gj6r-f6jm-p744CGA-h6fj-px4j-jg6xCGA-h8m4-37pp-wjmfCGA-hg82-82q9-32q7CGA-hgjr-7r6w-rccvCGA-hv8m-8mp7-6r93CGA-jg4h-w2jm-pqcmCGA-jjq5-pqwx-vq57CGA-jxx9-75wr-cv9hCGA-m5xh-3v2f-hrcmCGA-m8wf-grqc-29g9CGA-m9pr-74fr-v8fwCGA-mcm5-g9fp-p8j9CGA-mv8c-9rv3-7ww3CGA-p354-ghg9-3r98CGA-pm54-wjh2-xmwpCGA-pqgw-mwj9-4ww5CGA-prpw-p382-3c8pCGA-pvqm-689v-834cCGA-qhc6-f4v7-2f5xCGA-qmpv-pg89-g2qxCGA-qp5x-3pf7-8mvxCGA-qpx9-cvqr-r8fcCGA-r3pr-xqph-jhrqCGA-r6g5-qp2q-6r9pCGA-r73x-2cph-4g7xCGA-r9qf-r3cv-7vp8CGA-r9x8-69x6-wmvqCGA-rf74-43f8-8vcrCGA-rgw4-g8r9-83rjCGA-rhwh-wf7p-9c9rCGA-rq6j-68gv-g7hcCGA-rr5v-qv3q-jp77CGA-rr79-gmmf-r39xCGA-rrjv-7w93-8hjxCGA-rv65-rfpw-xx56CGA-rvcg-5g5h-mxmjCGA-rvgw-xw5f-9h8gCGA-rw3j-fv9p-ww6vCGA-rw7r-6cvh-f5hhCGA-rxw4-c2xg-q97cCGA-v344-97p3-wmh5CGA-v6jw-4475-98rvCGA-v6qh-233j-x6gxCGA-v7fg-8gr2-r2pwCGA-vcm8-qgwx-798vCGA-vffg-8qrc-gpwxCGA-vh6c-3mjh-59hgCGA-vmpm-2w9p-c4h7CGA-vp6g-6v9g-wh33CGA-vw3x-296w-r6cwCGA-vwpx-mgh9-334rCGA-w39c-c7w4-3gfxCGA-w7r7-pqp7-g792CGA-wgq7-2mm9-637fCGA-whqp-8j8r-57j7CGA-whv9-jp9c-2fx6CGA-wvwm-hhjq-f4jcCGA-x2gm-4f5v-v38wCGA-x3pm-9v8p-j2rxCGA-x3vm-2m6j-wmqpCGA-x52m-jrwm-wm55CGA-x7vm-5h8g-vfwhCGA-x9hp-hrfg-hg4qCGA-xccj-f2f8-wggqCGA-xcpx-ffrq-52ppCGA-xf3c-mvqc-jqcjCGA-xg49-726j-2q6vCGA-xj23-fqg6-823mCGA-xrcr-fh62-77fjCGA-2m6v-v6gc-ffffCGA-2rc8-5xhh-73c4CGA-33rh-889g-9m5wCGA-388c-26j5-55hxCGA-4r45-xpv9-58xqCGA-6gj3-wp8h-vrrmCGA-6p45-rfqw-5q4cCGA-7rjm-c4w9-9j75CGA-97gh-cw7w-f892CGA-9crh-927h-gg52CGA-c489-hr5x-mf29CGA-f27q-6mv2-72hjCGA-fg2j-x6qj-wg78CGA-fgh2-pgc9-mrqcCGA-frg5-wf2w-jffgCGA-g2rj-qm5w-mrqvCGA-g6f9-4259-6j7wCGA-gpmv-qxwm-64h4CGA-h86p-qmrv-qgmpCGA-h8g7-phj7-f5hhCGA-h8gm-4gwr-hrhwCGA-hgfm-vv3x-vxj7CGA-hm25-vc52-8x48CGA-hvw5-jx39-w8p6CGA-hwj8-ww89-c76rCGA-j544-28p4-349pCGA-j774-w8h9-22cvCGA-jr82-qw6f-ccv5CGA-m8px-fqhg-rq2hCGA-p56g-f7q8-cqq5CGA-pm6j-cjj9-jhc5CGA-rmhg-m9w4-6m3rCGA-v47p-7pc3-hp49CGA-vcjw-9rg4-wqg4CGA-vjmg-c8wc-pqqqCGA-vv7j-qq63-cgfjCGA-2cqg-5cxf-4pg7CGA-2fq3-c22x-cwjfCGA-2gf5-3q9p-g8qvCGA-2mhw-jvq2-m3xrCGA-2x38-43fh-jqf7CGA-36cr-4qfc-m698CGA-4fhc-wcf5-xvm7CGA-56xc-fwwx-x9rfCGA-5r28-xggq-g657CGA-679j-q32m-5fv7CGA-6fj2-xhpx-44hhCGA-6m8m-cfgc-wj9wCGA-74xr-6j8c-phf2CGA-7f86-4wqj-2gf8CGA-7f8x-hrcc-p9c7CGA-7hxj-58f4-99xfCGA-856m-7xxh-299rCGA-89fx-c8p8-28xvCGA-8v26-6pxx-gcx7CGA-95cp-x2v3-wjcvCGA-9hw8-7pc3-v323CGA-cwwp-75xc-m694CGA-cxfh-wwfh-jc97CGA-f99q-4vfw-pw92CGA-gc74-9pw9-fv2xCGA-gh2v-rqh4-6fmmCGA-h6gq-qx2m-fx39CGA-h8j8-9q6x-863mCGA-hp7c-pj89-33whCGA-j769-grm6-f23rCGA-jcgc-9c77-32cgCGA-jhjm-qc9w-rgjfCGA-jp7v-mq2j-fp72CGA-jrrx-mxqr-438wCGA-m43r-gv5j-wmw5CGA-m84p-vq96-x334CGA-mx27-j766-mrvqCGA-p398-mxwg-wf79CGA-p5h3-m7pq-cp6hCGA-p7gj-3949-vxmwCGA-p8pv-72gc-6v5gCGA-pg4j-w43m-fq44CGA-pjrr-wgv9-7hjpCGA-q22m-3vjx-f4v4CGA-qwx7-8gr2-j9vhCGA-rhc2-ghjf-6pf7CGA-vwhc-h2j7-4xw3CGA-w3jx-m42j-p6jjCGA-w433-35j2-x87qCGA-w7ph-9mph-658fCGA-wghp-c2r6-p5gmCGA-wrwh-x8rh-vhmhCGA-x536-x748-h25gCGA-x56m-99gp-r93jCGA-x8hx-xjr4-v59gCGA-xcch-vvfp-25x4CGA-25g5-q6q2-33mfCGA-262m-75fm-rgp2CGA-2wg5-8298-2c2fCGA-2xrh-v8fg-c6j7CGA-3pr6-8xf8-gp3hCGA-3w85-9p89-qfjgCGA-3wqx-mhxv-qv94CGA-5577-3whh-mm7jCGA-5c75-xhqw-q232CGA-5gvf-5857-rg42CGA-5hj7-x279-h3mxCGA-5vxj-7mgm-hvgqCGA-638j-5hx5-7hgvCGA-643v-994j-2884CGA-6486-cq7v-9x3wCGA-6v22-qqpv-v9q4CGA-7m6c-xw43-h896CGA-7qm7-49w3-x955CGA-7xgq-c5gr-gm47CGA-87gj-8gqr-gv3hCGA-8hrj-fhf6-pg6gCGA-c2hx-cw77-r2fjCGA-cm75-p6x5-prm2CGA-f2c6-5hxp-7jc8CGA-f45f-gvcw-p762CGA-f53c-37jp-9ffmCGA-fj2f-m9ww-rp3vCGA-fq9p-xxrv-5qhqCGA-hqwq-grm2-pwf3CGA-jwh8-rc6r-m8mwCGA-mcw7-3rhm-c7x5CGA-mfwr-53cr-945xCGA-mrp7-6c4r-j5cpCGA-p574-wm74-9x89CGA-pmc5-qr4x-rvhxCGA-q2pv-c43g-2cfxCGA-r4j2-9w24-jprfCGA-r9fj-fc8f-v3xwCGA-rw4v-6qcq-333jCGA-vx25-2w9c-7jgcCGA-x53w-8884-4fw7CGA-xg6x-49f2-mxcr
Advisory lineage Upstream: 0 Downstream: 15
Modified
Published: 02 Dec 2020, 16:20
Last modified:01 Dec 2025, 15:45

Vulnerability Summary

Overall Risk (default)
low
23/100
CVSS Score
5.3 MEDIUM
v3.1 (nvd)
EPSS Score
9.03% LOW
9% probability +8.53%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

02 Dec 2020, 16:20
Published
Vulnerability first disclosed
01 Dec 2025, 15:45
Last Modified
Vulnerability information updated

Description

Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.

CVSS Metrics

  • v3.1•MEDIUM•Score: 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
  • v2.0•MEDIUM•Score: 5AV:N/AC:L/Au:N/C:N/I:P/A:N

EPSS Trends

Current EPSS score: 9.03%• Percentile: 95%

Affected Systems

  • apache•httpclient

    < 4.5.13 | ≥ 5.0.0, < 5.0.3

  • chainguard•druid

    all | < 35.0.1-r1

  • chainguard•eco-java-gradle-1.11

    all

  • chainguard•eco-java-gradle-2.0

    all

  • chainguard•eco-java-gradle-2.1

    all

  • chainguard•eco-java-gradle-2.10

    all

  • chainguard•eco-java-gradle-2.11

    all

  • chainguard•eco-java-gradle-2.12

    all

  • chainguard•eco-java-gradle-2.13

    all

  • chainguard•eco-java-gradle-2.14

    all

  • chainguard•eco-java-gradle-2.14.1

    all

  • chainguard•eco-java-gradle-2.2

    all

  • chainguard•eco-java-gradle-2.2.1

    all

  • chainguard•eco-java-gradle-2.3

    all

  • chainguard•eco-java-gradle-2.4

    all

  • chainguard•eco-java-gradle-2.5

    all

  • chainguard•eco-java-gradle-2.6

    all

  • chainguard•eco-java-gradle-2.7

    all

  • chainguard•eco-java-gradle-2.8

    all

  • chainguard•eco-java-gradle-2.9

    all

  • chainguard•eco-java-gradle-3.0

    all

  • chainguard•eco-java-gradle-3.1

    all

  • chainguard•eco-java-gradle-3.2

    all

  • chainguard•eco-java-gradle-3.2.1

    all

  • chainguard•eco-java-gradle-3.3

    all

  • chainguard•eco-java-gradle-3.4

    all

  • chainguard•eco-java-gradle-3.4.1

    all

  • chainguard•eco-java-gradle-3.5

    all

  • chainguard•eco-java-gradle-3.5.1

    all

  • chainguard•eco-java-gradle-4.0

    all

  • chainguard•eco-java-gradle-4.0.1

    all

  • chainguard•eco-java-gradle-4.0.2

    all

  • chainguard•eco-java-gradle-4.1

    all

  • chainguard•eco-java-gradle-4.10

    all

  • chainguard•eco-java-gradle-4.10.1

    all

  • chainguard•eco-java-gradle-4.10.2

    all

  • chainguard•eco-java-gradle-4.10.3

    all

  • chainguard•eco-java-gradle-4.2

    all

  • chainguard•eco-java-gradle-4.2.1

    all

  • chainguard•eco-java-gradle-4.3

    all

  • chainguard•eco-java-gradle-4.3.1

    all

  • chainguard•eco-java-gradle-4.4

    all

  • chainguard•eco-java-gradle-4.4.1

    all

  • chainguard•eco-java-gradle-4.5

    all

  • chainguard•eco-java-gradle-4.5.1

    all

  • chainguard•eco-java-gradle-4.6

    all

  • chainguard•eco-java-gradle-4.7

    all

  • chainguard•eco-java-gradle-4.8

    all

  • chainguard•eco-java-gradle-4.8.1

    all

  • chainguard•eco-java-gradle-4.9

    all

Showing first 50 affected entries in server-rendered view.

References (124)