CVE-2013-4366 Hostname verification in Apache HttpClient 4.3 was disabled by default

What is CVE-2013-4366?

CVE-2013-4366 is a critical vulnerability in n/a, published on 30 Oct 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

http/impl/client/HttpClientBuilder.java in Apache HttpClient 4.3.x before 4.3.1 does not ensure that X509HostnameVerifier is not null, which allows attackers to have unspecified impact via vectors involving hostname verification.

Weakness: CWE-20

Which versions are affected by CVE-2013-4366?

2 open source packages ship an affected version, including org.apache.httpcomponents:httpclient. It affects 1 product.

Products include Apache Httpclient.

How do I fix CVE-2013-4366?

Upgrade org.apache.httpcomponents:httpclient to 4.3.1 or later.

Is CVE-2013-4366 being exploited?

There is no known exploitation of CVE-2013-4366 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2026-71290 Apache HttpComponents Client: TLS hostname verification silently disabled on the async transport (default config, MITM) Critical 9.1
• CVE-2025-27820 Apache HttpComponents: PSL (Public Suffix List) validation bypass High 7.5
• CVE-2026-40542 Apache HttpClient accepts SCRAM-SHA-256 authentication without proper mutual authentication verification High 7.3
• CVE-2012-5783 Improper Certificate Validation in Apache Commons HttpClient Medium 5.8
• CVE-2026-64607 Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2013-4366, GHSA-pqwh-44jj-p5rm.