CVE-2016-2402: Improper Certificate Validation in OkHttp
Summary
CVE-2016-2402: Improper Certificate Validation in OkHttp. Affects com.squareup.okhttp3:okhttp across 2 version ranges.
< 2.7.4
>= 3.0.0, < 3.1.2
Fixed in 2.7.4 or 3.1.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OkHttp is a popular open-source HTTP client for Java applications. It provides a simple and efficient way to make HTTP requests and handle responses. OkHttp is widely used in various projects and frameworks for network communication. However, versions before 2.7.4 and 3.x before 3.1.2 are vulnerable to an improper certificate validation issue.
Vulnerability Detail
The vulnerability in OkHttp allows man-in-the-middle attackers to bypass certificate pinning. Certificate pinning is a security mechanism that ensures the client only accepts specific certificates when establishing a secure connection. However, an attacker can exploit this vulnerability by sending a certificate chain with a certificate from a non-pinned trusted CA and the pinned certificate. This allows the attacker to intercept and manipulate the communication between the client and the server.
How To Fix
Latest published version: 5.5.1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.7.42.7.4 -
>= 3.0.0, < 3.1.23.1.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the fixed versions of OkHttp to ensure the security of the application.
Conclusion
The improper certificate validation vulnerability in OkHttp can be mitigated by updating to the fixed versions. It is crucial to keep the dependencies up to date to ensure the security of the application. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for com.squareup.okhttp3:okhttp →
FAQ
OkHttp is an open-source HTTP client for Java applications that simplifies network communication.
Certificate pinning is a security mechanism that ensures the client only accepts specific certificates when establishing a secure connection.
The vulnerability allows man-in-the-middle attackers to bypass certificate pinning and intercept the communication between the client and the server, potentially leading to unauthorized access or data manipulation.
No, only versions before 2.7.4 for OkHttp 2.x and versions before 3.1.2 for OkHttp 3.x are affected. It is recommended to update to the fixed versions.
No, updating to the fixed versions of OkHttp is the only known solution to address this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.squareup.okhttp3:okhttp.
