CVE catalog

CVE-2020-13956

Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host

[CVE catalog]

Severity: Medium · CVSS 5.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Published: Oct 7, 2020, 10:00:00 PM UTC
Updated: Oct 8, 2026, 7:16:54 PM UTC
Source: [NVD] · [CVE record]
EPSS: 9.03% · Oct 25, 2026

Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	httpcomponents-client	sid	`4.5.14-1`	fixed
Debian	httpcomponents-client	forky	`4.5.14-1`	fixed
Debian	httpcomponents-client	trixie	`4.5.14-1`	fixed
Debian	httpcomponents-client	bookworm	`4.5.14-1`	fixed
Cpe	httpclient	Not reported	`4.5.13`	fixed
Cpe	httpclient	Not reported	`5.0.3`	fixed
Cpe	quarkus	Not reported	`1.7.6`	fixed
Cpe	data_integrator	Not reported	Not reported	unknown
Cpe	data_integrator	Not reported	Not reported	unknown
Cpe	jd_edwards_enterpriseone_orchestrator	Not reported	`9.2.6.0`	fixed
Cpe	jd_edwards_enterpriseone_tools	Not reported	`9.2.6.0`	fixed
Cpe	nosql_database	Not reported	`20.3`	fixed
Cpe	peoplesoft_enterprise_peopletools	Not reported	Not reported	unknown
Cpe	peoplesoft_enterprise_peopletools	Not reported	Not reported	unknown
Cpe	peoplesoft_enterprise_pt_peopletools	Not reported	Not reported	unknown
Cpe	peoplesoft_enterprise_pt_peopletools	Not reported	Not reported	unknown
Cpe	peoplesoft_enterprise_pt_peopletools	Not reported	Not reported	unknown
Cpe	primavera_unifier	Not reported	Not reported	unknown
Cpe	primavera_unifier	Not reported	Not reported	unknown
Cpe	primavera_unifier	Not reported	Not reported	unknown
Cpe	primavera_unifier	Not reported	Not reported	unknown
Cpe	primavera_unifier	Not reported	Not reported	unknown
Cpe	primavera_unifier	Not reported	Not reported	unknown
Cpe	retail_customer_management_and_segmentation_foundation	Not reported	Not reported	unknown
Ubuntu	httpcomponents-client	pro	`4.5.9-1`	vulnerable
Ubuntu	httpcomponents-client	pro	`4.5.10-2`	vulnerable
Ubuntu	httpcomponents-client	pro	`4.5.11-1`	vulnerable
Ubuntu	httpcomponents-client	pro	`4.5.11-1ubuntu0.1~esm1`	fixed
Ubuntu	httpcomponents-client	pro	`4.5.9-1`	vulnerable
Ubuntu	httpcomponents-client	pro	`4.5.10-2`	vulnerable
Ubuntu	httpcomponents-client	pro	`4.5.11-1`	vulnerable
Ubuntu	httpcomponents-client	pro	`4.5.11-1ubuntu0.1~esm1`	fixed
Opensuse	httpcomponents-client	tumbleweed	`4.5.14-1.1`	fixed
Suse	httpcomponents-client	linux enterprise module for development tools 15 sp5	`4.5.14-150200.3.9.1`	fixed
Suse	httpcomponents-core	linux enterprise module for development tools 15 sp5	`4.4.14-150200.3.9.1`	fixed
Suse	httpcomponents-client	linux enterprise module for development tools 15 sp6	`4.5.14-150200.3.9.1`	fixed
Suse	httpcomponents-core	linux enterprise module for development tools 15 sp6	`4.4.14-150200.3.9.1`	fixed
Suse	httpcomponents-client	manager server module 4.3	`4.5.14-150200.3.9.1`	fixed
Suse	httpcomponents-core	manager server module 4.3	`4.4.14-150200.3.9.1`	fixed
Opensuse	httpcomponents-client	leap 15.5	`4.5.14-150200.3.9.1`	fixed
Opensuse	httpcomponents-core	leap 15.5	`4.4.14-150200.3.9.1`	fixed
Opensuse	httpcomponents-client	leap 15.6	`4.5.14-150200.3.9.1`	fixed
Opensuse	httpcomponents-core	leap 15.6	`4.4.14-150200.3.9.1`	fixed
Opensuse	clojure	tumbleweed	`1.10.3.855-1.2`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	httpcomponents-client	source	sid	`4.5.13-1`	not yet assigned	Not reported	Not reported
Debian	httpcomponents-client	source	forky	`4.5.13-1`	not yet assigned	Not reported	Not reported
Debian	httpcomponents-client	source	trixie	`4.5.13-1`	not yet assigned	Not reported	Not reported
Debian	httpcomponents-client	source	bookworm	`4.5.13-1`	not yet assigned	Not reported	Not reported
Cpe	httpclient	cpe	Not reported	`4.5.13`	Not reported	NVD-CVE-2020-13956	Not reported
Cpe	httpclient	cpe	Not reported	`5.0.3`	Not reported	NVD-CVE-2020-13956	Not reported
Cpe	quarkus	cpe	Not reported	`1.7.6`	Not reported	NVD-CVE-2020-13956	Not reported
Cpe	jd_edwards_enterpriseone_orchestrator	cpe	Not reported	`9.2.6.0`	Not reported	NVD-CVE-2020-13956	Not reported
Cpe	jd_edwards_enterpriseone_tools	cpe	Not reported	`9.2.6.0`	Not reported	NVD-CVE-2020-13956	Not reported
Cpe	nosql_database	cpe	Not reported	`20.3`	Not reported	NVD-CVE-2020-13956	Not reported
Ubuntu	httpcomponents-client	deb	pro	`4.5.11-1ubuntu0.1~esm1`	Not reported	UBUNTU-CVE-2020-13956	Not reported
Ubuntu	httpcomponents-client	deb	pro	`4.5.11-1ubuntu0.1~esm1`	Not reported	USN-5239-1	Not reported
Opensuse	httpcomponents-client	rpm	tumbleweed	`4.5.14-1.1`	Not reported	OPENSUSE-SU-2024:14478-1	Not reported
Suse	httpcomponents-client	rpm	linux enterprise module for development tools 15 sp5	`4.5.14-150200.3.9.1`	Not reported	SUSE-SU-2024:4036-1	Not reported
Suse	httpcomponents-core	rpm	linux enterprise module for development tools 15 sp5	`4.4.14-150200.3.9.1`	Not reported	SUSE-SU-2024:4036-1	Not reported
Suse	httpcomponents-client	rpm	linux enterprise module for development tools 15 sp6	`4.5.14-150200.3.9.1`	Not reported	SUSE-SU-2024:4036-1	Not reported
Suse	httpcomponents-core	rpm	linux enterprise module for development tools 15 sp6	`4.4.14-150200.3.9.1`	Not reported	SUSE-SU-2024:4036-1	Not reported
Suse	httpcomponents-client	rpm	manager server module 4.3	`4.5.14-150200.3.9.1`	Not reported	SUSE-SU-2024:4036-1	Not reported
Suse	httpcomponents-core	rpm	manager server module 4.3	`4.4.14-150200.3.9.1`	Not reported	SUSE-SU-2024:4036-1	Not reported
Opensuse	httpcomponents-client	rpm	leap 15.5	`4.5.14-150200.3.9.1`	Not reported	SUSE-SU-2024:4036-1	Not reported
Opensuse	httpcomponents-core	rpm	leap 15.5	`4.4.14-150200.3.9.1`	Not reported	SUSE-SU-2024:4036-1	Not reported
Opensuse	httpcomponents-client	rpm	leap 15.6	`4.5.14-150200.3.9.1`	Not reported	SUSE-SU-2024:4036-1	Not reported
Opensuse	httpcomponents-core	rpm	leap 15.6	`4.4.14-150200.3.9.1`	Not reported	SUSE-SU-2024:4036-1	Not reported
Opensuse	clojure	rpm	tumbleweed	`1.10.3.855-1.2`	Not reported	OPENSUSE-SU-2024:10687-1	Not reported

OpenFactory catalog packages

[openSUSE Tumbleweed]

[httpcomponents-client-cache]Unknown
Source package: [httpcomponents-client]
Details (1)
- 4.5.14-2.1 · noarch · tumbleweed
  Unknown · Fixed: 4.5.14-1.1
  Version impact unknown
  nvd · httpcomponents-client · opensuse · tumbleweed
[httpcomponents-client-javadoc]Unknown
Source package: [httpcomponents-client]
Details (1)
- 4.5.14-2.1 · noarch · tumbleweed
  Unknown · Fixed: 4.5.14-1.1
  Version impact unknown
  nvd · httpcomponents-client · opensuse · tumbleweed
[clojure]Fixed
Source package: [clojure]
Details (1)
- 1.12.3.1577-1.3 · noarch · tumbleweed
  Fixed · Fixed: 1.10.3.855-1.2
  nvd · clojure · opensuse · tumbleweed
[httpcomponents-client]Fixed
Source package: [httpcomponents-client]
Details (1)
- 4.5.14-2.1 · noarch · tumbleweed
  Fixed · Fixed: 4.5.14-1.1
  nvd · httpcomponents-client · opensuse · tumbleweed

[Debian 12 (Bookworm)]

[libhttpclient-java]Fixed
Source package: [httpcomponents-client]
Details (2)
- 4.5.14-1 · all · bookworm
  Fixed · Fixed: 4.5.13-1
  nvd · httpcomponents-client · debian · bookworm; nvd · httpcomponents-client · debian · 12
- 4.5.14-1 · all · bookworm
  Fixed · Fixed: 4.5.13-1
  nvd · httpcomponents-client · debian · bookworm; nvd · httpcomponents-client · debian · 12
[libhttpmime-java]Fixed
Source package: [httpcomponents-client]
Details (2)
- 4.5.14-1 · all · bookworm
  Fixed · Fixed: 4.5.13-1
  nvd · httpcomponents-client · debian · bookworm; nvd · httpcomponents-client · debian · 12
- 4.5.14-1 · all · bookworm
  Fixed · Fixed: 4.5.13-1
  nvd · httpcomponents-client · debian · bookworm; nvd · httpcomponents-client · debian · 12

[Debian 13 (Trixie)]

[libhttpclient-java]Fixed
Source package: [httpcomponents-client]
Details (2)
- 4.5.14-1 · all · trixie
  Fixed · Fixed: 4.5.13-1
  nvd · httpcomponents-client · debian · 13
- 4.5.14-1 · all · trixie
  Fixed · Fixed: 4.5.13-1
  nvd · httpcomponents-client · debian · 13
[libhttpmime-java]Fixed
Source package: [httpcomponents-client]
Details (2)
- 4.5.14-1 · all · trixie
  Fixed · Fixed: 4.5.13-1
  nvd · httpcomponents-client · debian · 13
- 4.5.14-1 · all · trixie
  Fixed · Fixed: 4.5.13-1
  nvd · httpcomponents-client · debian · 13

Observed: Oct 23, 2026, 5:47:45 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]