VYPR
← All advisories
Moderate severityOSV Advisory· Published Dec 2, 2020· Updated Dec 1, 2025

CVE-2020-13956

CVE-2020-13956

Description

Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Apache HttpClient incorrectly handles malformed URIs, potentially sending requests to an unintended host, leading to SSRF-like attacks.

Vulnerability

Overview

Apache HttpClient versions prior to 4.5.13 and 5.0.3 contain a flaw in handling malformed authority components in request URIs. When a URI is passed as a java.net.URI object, the library may misinterpret the authority component, causing it to route the HTTP request to a different host than intended [1].

Exploitation

An attacker can provide a specially crafted URI with a malformed authority (e.g., containing unexpected characters or format) to an application that uses Apache HttpClient. The library's incorrect parsing can result in the request being sent to an attacker-controlled server, bypassing the intended destination [1].

Impact

Successful exploitation allows an attacker to perform server-side request forgery (SSRF). This could enable access to internal systems, exfiltration of sensitive data, or impersonation of the vulnerable client against other servers [1].

Mitigation

The vulnerability is fixed in Apache HttpClient versions 4.5.13 and 5.0.3. Users should upgrade to these or later versions. No official workarounds have been published [1].

References
  1. NVD - CVE-2020-13956

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.apache.httpcomponents:httpclientMaven
< 4.5.134.5.13
org.apache.httpcomponents:httpclientMaven
>= 5.0.0, < 5.0.35.0.3

Affected products

201

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

122

News mentions

0

No linked articles in our index yet.