Read the docs
TI-2020-10932 Aliases CVE-2020-13956GHSA-7r82-7xv7-xcpj

Improper input validation in Apache HttpClient

Priority MEDIUM 42CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · Low · None
Fix status
Partial Red Hat: 16 fixed, 18 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.

Summary

Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.09032 95th percentileScored 2026-11-07
Fix Partial org.apache.httpcomponents:httpclient (Maven): 4.5.13, 5.0.3Red Hat: 16 advisoriesRed Hat: 16 fixed, 18 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Apache HttpClient4.5.12 and prior, 5.0.2 and prior—No fix listedCNA
—org.apache.httpcomponents:httpclient (Maven)before 4.5.134.5.13Patch availableGHSA-7r82-7xv7-xcpj
—org.apache.httpcomponents:httpclient (Maven)5.0.0 to before 5.0.35.0.3Patch availableGHSA-7r82-7xv7-xcpj
  • Apache HttpClient Vendor— Affected 4.5.12 and prior, 5.0.2 and prior Fixed in — No fix listed CNA
  • org.apache.httpcomponents:httpclient (Maven) Vendor— Affected before 4.5.13 Fixed in 4.5.13 Patch available GHSA-7r82-7xv7-xcpj
  • org.apache.httpcomponents:httpclient (Maven) Vendor— Affected 5.0.0 to before 5.0.3 Fixed in 5.0.3 Patch available GHSA-7r82-7xv7-xcpj

CPE configurations NVD · 30

CPEVersionsRoleVendor
cpe:2.3:a:apache:httpclient:*:*:*:*:*:*:*:*before 4.5.13; 5.0.0 to before 5.0.3VulnerableApache
cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:*before 1.7.6Vulnerablequarkusio
cpe:2.3:a:oracle:data_integrator:12.2.1.3.0:*:*:*:*:*:*:*12.2.1.3.0VulnerableOracle
cpe:2.3:a:oracle:data_integrator:12.2.1.4.0:*:*:*:*:*:*:*12.2.1.4.0VulnerableOracle
cpe:2.3:a:oracle:jd_edwards_enterpriseone_orchestrator:*:*:*:*:*:*:*:*before 9.2.6.0VulnerableOracle
cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*before 9.2.6.0VulnerableOracle
cpe:2.3:a:oracle:nosql_database:*:*:*:*:*:*:*:*before 20.3VulnerableOracle
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:*8.57VulnerableOracle
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*8.58VulnerableOracle
cpe:2.3:a:oracle:peoplesoft_enterprise_pt_peopletools:8.57:*:*:*:*:*:*:*8.57VulnerableOracle
  • cpe:2.3:a:apache:httpclient:*:*:*:*:*:*:*:* Versions before 4.5.13; 5.0.0 to before 5.0.3 Vulnerable ·Apache
  • cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:* Versions before 1.7.6 Vulnerable ·quarkusio
  • cpe:2.3:a:oracle:data_integrator:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:data_integrator:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jd_edwards_enterpriseone_orchestrator:*:*:*:*:*:*:*:* Versions before 9.2.6.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:* Versions before 9.2.6.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:nosql_database:*:*:*:*:*:*:*:* Versions before 20.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:* Versions 8.57 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:* Versions 8.58 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:peoplesoft_enterprise_pt_peopletools:8.57:*:*:*:*:*:*:* Versions 8.57 Vulnerable ·Oracle
Show 20 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:oracle:peoplesoft_enterprise_pt_peopletools:8.58:*:*:*:*:*:*:*8.58VulnerableOracle
cpe:2.3:a:oracle:peoplesoft_enterprise_pt_peopletools:8.59:*:*:*:*:*:*:*8.59VulnerableOracle
cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:*17.7 – 17.12VulnerableOracle
cpe:2.3:a:oracle:primavera_unifier:16.1:*:*:*:*:*:*:*16.1VulnerableOracle
cpe:2.3:a:oracle:primavera_unifier:16.2:*:*:*:*:*:*:*16.2VulnerableOracle
cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:*18.8VulnerableOracle
cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:*19.12VulnerableOracle
cpe:2.3:a:oracle:primavera_unifier:20.12:*:*:*:*:*:*:*20.12VulnerableOracle
cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:*:*:*:*:*:*:*:*16.0 – 19.0VulnerableOracle
cpe:2.3:a:oracle:spatial_studio:*:*:*:*:*:*:*:*before 20.1.1VulnerableOracle
cpe:2.3:a:oracle:sql_developer:*:*:*:*:*:*:*:*before 20.4.1.407.0006VulnerableOracle
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:oracle:commerce_guided_search:11.3.2:*:*:*:*:*:*:*11.3.2VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_service_communication_proxy:1.14.0:*:*:*:*:*:*:*1.14.0VulnerableOracle
cpe:2.3:a:oracle:sql_developer:*:*:*:*:*:*:*:*before 21.99VulnerableOracle
cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*12.2.1.4.0VulnerableOracle
cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*14.1.1.0.0VulnerableOracle
  • cpe:2.3:a:oracle:peoplesoft_enterprise_pt_peopletools:8.58:*:*:*:*:*:*:* Versions 8.58 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:peoplesoft_enterprise_pt_peopletools:8.59:*:*:*:*:*:*:* Versions 8.59 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:* Versions 17.7 – 17.12 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_unifier:16.1:*:*:*:*:*:*:* Versions 16.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_unifier:16.2:*:*:*:*:*:*:* Versions 16.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:* Versions 18.8 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:* Versions 19.12 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_unifier:20.12:*:*:*:*:*:*:* Versions 20.12 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:*:*:*:*:*:*:*:* Versions 16.0 – 19.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:spatial_studio:*:*:*:*:*:*:*:* Versions before 20.1.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:sql_developer:*:*:*:*:*:*:*:* Versions before 20.4.1.407.0006 Vulnerable ·Oracle
  • cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:oracle:commerce_guided_search:11.3.2:*:*:*:*:*:*:* Versions 11.3.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_service_communication_proxy:1.14.0:*:*:*:*:*:*:* Versions 1.14.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:sql_developer:*:*:*:*:*:*:*:* Versions before 21.99 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:* Versions 14.1.1.0.0 Vulnerable ·Oracle

Remediation

  • Fix · GHSA-7r82-7xv7-xcpj org.apache.httpcomponents:httpclient (Maven) Fixed in 4.5.13 Advisory →
  • Fix · GHSA-7r82-7xv7-xcpj org.apache.httpcomponents:httpclient (Maven) Fixed in 5.0.3 Advisory →

Red Hat 16 advisories

  • RHSA-2023:3954 Released 2023-06-29 · Red Hat rating Critical
    Red Hat Fuse 7.12 release and security update
    • Red Hat Fuse 7.12
  • RHSA-2022:1861 Released 2022-05-10 · Red Hat rating Moderate
    maven:3.5 security update
    • Red Hat Enterprise Linux AppStream (v. 8) aopalliance-1.0-17.module+el8+2452+b359bfcd.noarch::maven:3.5, aopalliance-1.0-17.module+el8+2452+b359bfcd.src::maven:3.5, apache-commons-cli-1.4-4.module+el8+2452+b359bfcd.noarch::maven:3.5 +47
  • RHSA-2022:1860 Released 2022-05-10 · Red Hat rating Moderate
    maven:3.6 security and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) aopalliance-1.0-20.module+el8.6.0+13337+afcb49ec.noarch::maven:3.6, aopalliance-1.0-20.module+el8.6.0+13337+afcb49ec.src::maven:3.6, apache-commons-cli-1.4-7.module+el8.6.0+13337+afcb49ec.noarch::maven:3.6 +47
Show 13 more Red Hat advisories
  • RHSA-2022:0722 Released 2022-03-01 · Red Hat rating Moderate
    rh-maven36-httpcomponents-client security update
    • Red Hat Software Collections for RHEL Workstation(v. 7) rh-maven36-httpcomponents-client-4.5.9-1.3.el7, rh-maven36-httpcomponents-client-javadoc-4.5.9-1.3.el7
    • Red Hat Software Collections for RHEL(v. 7) rh-maven36-httpcomponents-client-4.5.9-1.3.el7, rh-maven36-httpcomponents-client-javadoc-4.5.9-1.3.el7
  • RHSA-2021:4100 Released 2021-11-02 · Red Hat rating Moderate
    Red Hat Integration - Service Registry release and security update [2.0.2.GA]
    • RHINT Service Registry 2.0.2 GA
  • RHSA-2021:3700 Released 2021-09-30 · Red Hat rating Moderate
    Red Hat AMQ Broker 7.9.0 release and security update
    • Red Hat AMQ 7.9.0
  • RHSA-2021:3140 Released 2021-08-11 · Red Hat rating Moderate
    Red Hat Fuse 7.9.0 release and security update
    • Red Hat Fuse 7.9
  • RHSA-2021:1044 Released 2021-03-30 · Red Hat rating Moderate
    Red Hat Process Automation Manager 7.10.1 security update
    • RHPAM 7.10.1
  • RHSA-2021:0811 Released 2021-03-11 · Red Hat rating Low
    Red Hat Integration Tech-Preview 3 Camel K security update
    • Red Hat Integration - Camel K - Tech-Preview 3
  • RHSA-2021:0603 Released 2021-02-17 · Red Hat rating Important
    Red Hat Decision Manager 7.10.0 security update
    • RHDM 7.10.0
  • RHSA-2021:0327 Released 2021-02-01 · Red Hat rating Important
    Red Hat Single Sign-On 7.4.5 security update
    • Red Hat Single Sign-On 7.4.5
  • RHSA-2021:0248 Released 2021-01-25 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.5 security update
    • Red Hat JBoss EAP 7.3 for BaseOS-8 eap7-activemq-artemis-2.9.0-7.redhat_00017.1.el8eap, eap7-activemq-artemis-cli-2.9.0-7.redhat_00017.1.el8eap, eap7-activemq-artemis-commons-2.9.0-7.redhat_00017.1.el8eap +47
  • RHSA-2021:0247 Released 2021-01-25 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.5 security update
    • Red Hat JBoss EAP 7.3 for RHEL 7 Server eap7-activemq-artemis-2.9.0-7.redhat_00017.1.el7eap, eap7-activemq-artemis-cli-2.9.0-7.redhat_00017.1.el7eap, eap7-activemq-artemis-commons-2.9.0-7.redhat_00017.1.el7eap +47
  • RHSA-2021:0246 Released 2021-01-25 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.5 security update
    • Red Hat JBoss EAP 7.3 for RHEL 6 Server eap7-activemq-artemis-2.9.0-7.redhat_00017.1.el6eap, eap7-activemq-artemis-cli-2.9.0-7.redhat_00017.1.el6eap, eap7-activemq-artemis-commons-2.9.0-7.redhat_00017.1.el6eap +47
  • RHSA-2021:0250 Released 2021-01-25 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.5 security update
    • Red Hat JBoss Enterprise Application Platform 7
  • RHSA-2021:0084 Released 2021-01-12 · Red Hat rating Moderate
    Red Hat build of Quarkus 1.7.6 release and security update
    • Red Hat build of Quarkus 1.7.6

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat BPM Suite 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix planned: Will not fix
Red Hat JBoss A-MQ 6AffectedNo fix planned: Out of support scope
Red Hat JBoss BRMS 5AffectedNo fix planned: Out of support scope
Red Hat JBoss BRMS 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Data Grid 7AffectedNo fix planned: Out of support scope
Red Hat JBoss Data Virtualization 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform 5AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse Service Works 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Operations Network 3AffectedNo fix planned: Out of support scope
Red Hat OpenShift Container Platform 3.11AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 4AffectedNo fix yet: Fix deferred
Red Hat Software CollectionsAffectedNo fix planned: Out of support scope
Red Hat build of OpenJDK 1.8AffectedNo fix yet
Red Hat build of OpenJDK 11AffectedNo fix yet
streams for Apache KafkaAffectedNo fix yet
RHDM 7.10.0Fixed RHSA-2021:0603
RHINT Service Registry 2.0.2 GAFixed RHSA-2021:4100
RHPAM 7.10.1Fixed RHSA-2021:1044
Red Hat AMQ 7.9.0Fixed RHSA-2021:3700
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2022:1860, RHSA-2022:1861
Red Hat Fuse 7.12Fixed RHSA-2023:3954
Red Hat Fuse 7.9Fixed RHSA-2021:3140
Red Hat Integration - Camel K - Tech-Preview 3Fixed RHSA-2021:0811
Red Hat JBoss EAP 7.3 for BaseOS-8Fixed RHSA-2021:0248
Red Hat JBoss EAP 7.3 for RHEL 6 ServerFixed RHSA-2021:0246
Red Hat JBoss EAP 7.3 for RHEL 7 ServerFixed RHSA-2021:0247
Red Hat JBoss Enterprise Application Platform 7Fixed RHSA-2021:0250
Red Hat Single Sign-On 7.4.5Fixed RHSA-2021:0327
Red Hat Software Collections for RHEL Workstation(v. 7)Fixed RHSA-2022:0722
Red Hat Software Collections for RHEL(v. 7)Fixed RHSA-2022:0722
Red Hat build of Quarkus 1.7.6Fixed RHSA-2021:0084
Not affected: 3 products
  • Red Hat Enterprise Linux 9
  • Red Hat Integration Service Registry
  • Red Hat OpenShift Container Platform 4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-13956
  2. 2026-10-03 Alias added: GHSA-7r82-7xv7-xcpj
  3. 2026-10-08 CVSS score added · CISA ADP
  4. 2026-10-08 Weakness changed · CISA ADP
  5. 2026-10-08 CISA SSVC decision points changed
  6. 2026-10-09 Priority changed: LOW → MEDIUM

References

Patch 4

Advisory 4

Other 114

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences