CVE-2020-13956: Cross-site scripting in Apache HttpClient
Summary
CVE-2020-13956: Cross-site scripting in Apache HttpClient. Affects org.apache.httpcomponents:httpclient across 2 version ranges.
< 4.5.13
>= 5.0.0, < 5.0.3
Fixed in 4.5.13 or 5.0.3, depending on the release line you run. How to fix ↓
Also tracked for
- httpcomponents-client · Debian:11
The same CVE-2020-13956 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache HttpClient is a widely used Java library for sending HTTP requests and handling HTTP responses. It provides a comprehensive set of features for interacting with web servers. However, versions prior to 4.5.13 and 5.0.3 are vulnerable to a cross-site scripting (XSS) attack. This vulnerability arises from the library's misinterpretation of malformed authority components in request URIs, leading to the selection of the wrong target host for request execution.
Vulnerability Detail
The vulnerability in Apache HttpClient allows an attacker to inject malicious scripts into web pages viewed by users. By exploiting this vulnerability, an attacker can execute arbitrary code in the context of the affected user's browser, potentially leading to unauthorized access, data theft, or other malicious activities. The vulnerability has a CVSS score of 5.3, indicating a moderate severity level.
How To Fix
Latest published version: 4.5.14 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 4.5.134.5.13 -
>= 5.0.0, < 5.0.35.0.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the fixed versions is not immediately feasible, a temporary workaround is to sanitize and validate user input before passing it to the Apache HttpClient library. This can help prevent the injection of malicious scripts and mitigate the risk of XSS attacks. Here is an example of how to sanitize user input in Java:
import org.apache.commons.text.StringEscapeUtils;
String userInput = ...; // User input from a form or other source
String sanitizedInput = StringEscapeUtils.escapeHtml4(userInput);
// Use the sanitizedInput in the HttpClient request
Conclusion
The vulnerability in Apache HttpClient can expose applications to cross-site scripting attacks, potentially leading to unauthorized access and data theft. It is crucial to upgrade to the fixed versions of Apache HttpClient (4.5.13 or 5.0.3) to mitigate this vulnerability. If immediate upgrading is not possible, sanitizing and validating user input can provide a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.httpcomponents:httpclient →
FAQ
Apache HttpClient is a Java library for sending HTTP requests and handling HTTP responses. It is widely used in various applications and provides a rich set of features for interacting with web servers.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by users. These scripts can be used to steal sensitive information, perform unauthorized actions, or deface websites.
The vulnerability in Apache HttpClient can allow attackers to inject malicious scripts into web pages viewed by users. This can lead to various security risks, including unauthorized access, data theft, and other malicious activities.
The CVSS score of this vulnerability is 5.3, indicating a moderate severity level.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities in software, using just the pom.xml file.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.httpcomponents:httpclient.
