CVE-2021-0341: Square OkHttp Accepts Incorrect Certificates Leading to Potential Information Disclosure
Summary
CVE-2021-0341: Square OkHttp can accept the wrong certificate. Affects com.squareup.okhttp3:okhttp versions < 4.9.2. Fixed in 4.9.2. How to fix ↓
Also tracked for
- platform/external/okhttp · Android
The same CVE-2021-0341 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Square OkHttp is a widely used open-source HTTP client for Android and Java applications, designed to facilitate efficient network communication. It supports features like connection pooling, GZIP compression, and response caching, making it a popular choice among developers. However, it is susceptible to a vulnerability that allows it to accept certificates for incorrect domains, which can lead to serious security issues.
Vulnerability Detail
The vulnerability arises from an issue in the verifyHostName method of OkHostnameVerifier.java, where improper cryptographic practices may allow a certificate intended for one domain to be accepted for another. This flaw can lead to remote information disclosure without requiring any additional execution privileges or user interaction, potentially exposing sensitive data to malicious actors.
How To Fix
Latest published version: 5.5.1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.9.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If an immediate update is not feasible, consider implementing additional domain validation checks in your application to ensure that certificates are only accepted for their intended domains. This can help mitigate the risk until the package is updated.
Conclusion
The vulnerability CVE-2021-0341 in Square OkHttp poses a significant risk by allowing incorrect certificates to be accepted, which can lead to information disclosure. It is crucial for developers to update to version 4.9.2 or later to protect their applications from potential exploitation.
See every vulnerability recorded for com.squareup.okhttp3:okhttp →
FAQ
CVE-2021-0341 is a vulnerability in the Square OkHttp library that allows the acceptance of incorrect certificates, potentially leading to information disclosure.
The vulnerability affects OkHttp versions prior to 4.9.2.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
If an immediate update is not possible, implement additional domain validation checks to mitigate risks until the package can be updated.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.squareup.okhttp3:okhttp.
