CVE-2011-1498: Apache HttpClient - Exposure of Sensitive Information
Summary
CVE-2011-1498: Exposure of Sensitive Information to an Unauthorized Actor in Apache HttpClient. Affects org.apache.httpcomponents:httpclient versions >= 4.0.0, < 4.1.1. Fixed in 4.1.1. How to fix ↓
Also tracked for
- httpcomponents-client · Debian:11
The same CVE-2011-1498 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache HttpClient is a widely used library for making HTTP requests in Java applications. It provides a comprehensive set of features for interacting with web servers. However, versions prior to 4.1.1 are vulnerable to an exposure of sensitive information issue when used with an authenticating proxy server. This vulnerability allows remote web servers to obtain sensitive information by logging the Proxy-Authorization header sent by HttpClient to the origin server.
Vulnerability Detail
The vulnerability in Apache HttpClient arises from the incorrect handling of the Proxy-Authorization header. When HttpClient is configured to use an authenticating proxy server, it includes the Proxy-Authorization header in requests to the origin server. This header contains sensitive information, such as authentication credentials. However, due to a flaw in versions prior to 4.1.1, this header is also sent to the remote web server, allowing it to log and potentially misuse this sensitive information. This vulnerability can lead to unauthorized access, identity theft, or other malicious activities.
How To Fix
Latest published version: 4.5.14 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.1.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to a fixed version of Apache HttpClient to mitigate the risk of sensitive information exposure.
Conclusion
The exposure of sensitive information vulnerability in Apache HttpClient can have severe consequences, including unauthorized access and identity theft. It is crucial to upgrade to Apache HttpClient version 4.1.1 or higher to mitigate the risk. If you need further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.httpcomponents:httpclient →
FAQ
Apache HttpClient is a Java library for making HTTP requests. It provides a convenient and powerful API for interacting with web servers.
This vulnerability allows remote web servers to obtain sensitive information, such as authentication credentials, by logging the Proxy-Authorization header sent by HttpClient to the origin server. This can lead to unauthorized access, identity theft, or other malicious activities.
Versions prior to 4.1.1 of Apache HttpClient are affected by this vulnerability. It is recommended to upgrade to version 4.1.1 or higher to mitigate the risk.
No, there is no known workaround for this vulnerability. It is crucial to upgrade to a fixed version of Apache HttpClient.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities in software, using just the pom.xml file.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.httpcomponents:httpclient.
