CVE catalog
CVE-2011-1498
httpcomponents-client: CVE-2011-1498
- Severity
- Medium
- Published
- Source
- [NVD] · [CVE record]
- EPSS
- 6.69% · Oct 25, 2026
Apache HttpClient 4.x before 4.1.1 in Apache HttpComponents, when used with an authenticating proxy server, sends the Proxy-Authorization header to the origin server, which allows remote web servers to obtain sensitive information by logging this header.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | httpcomponents-client | sid | 4.5.14-1 | fixed |
| Debian | httpcomponents-client | forky | 4.5.14-1 | fixed |
| Debian | httpcomponents-client | trixie | 4.5.14-1 | fixed |
| Debian | httpcomponents-client | bookworm | 4.5.14-1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | httpcomponents-client | source | sid | 4.1.1-1 | not yet assigned | Not reported | [628727] |
| Debian | httpcomponents-client | source | forky | 4.1.1-1 | not yet assigned | Not reported | [628727] |
| Debian | httpcomponents-client | source | trixie | 4.1.1-1 | not yet assigned | Not reported | [628727] |
| Debian | httpcomponents-client | source | bookworm | 4.1.1-1 | not yet assigned | Not reported | [628727] |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [libhttpclient-java]Fixed
Source package: [httpcomponents-client]
Details (2)
4.5.14-1· all · bookwormFixed · Fixed:
4.1.1-1dsa · httpcomponents-client · debian · bookworm; dsa · httpcomponents-client · debian · 12
4.5.14-1· all · bookwormFixed · Fixed:
4.1.1-1dsa · httpcomponents-client · debian · bookworm; dsa · httpcomponents-client · debian · 12
- [libhttpmime-java]Fixed
Source package: [httpcomponents-client]
Details (2)
4.5.14-1· all · bookwormFixed · Fixed:
4.1.1-1dsa · httpcomponents-client · debian · bookworm; dsa · httpcomponents-client · debian · 12
4.5.14-1· all · bookwormFixed · Fixed:
4.1.1-1dsa · httpcomponents-client · debian · bookworm; dsa · httpcomponents-client · debian · 12
[Debian 13 (Trixie)]
- [libhttpclient-java]Fixed
Source package: [httpcomponents-client]
Details (2)
4.5.14-1· all · trixieFixed · Fixed:
4.1.1-1dsa · httpcomponents-client · debian · 13
4.5.14-1· all · trixieFixed · Fixed:
4.1.1-1dsa · httpcomponents-client · debian · 13
- [libhttpmime-java]Fixed
Source package: [httpcomponents-client]
Details (2)
4.5.14-1· all · trixieFixed · Fixed:
4.1.1-1dsa · httpcomponents-client · debian · 13
4.5.14-1· all · trixieFixed · Fixed:
4.1.1-1dsa · httpcomponents-client · debian · 13
Observed: