Skip to content

[Aikido] Fix security issue in httpclient via minor version upgrade from 4.5.2 to 4.5.13 - #3

Open
aikido-autofix[bot] wants to merge 1 commit into
developfrom
fix/aikido-security-update-packages-51295289-4ipp
Open

[Aikido] Fix security issue in httpclient via minor version upgrade from 4.5.2 to 4.5.13#3
aikido-autofix[bot] wants to merge 1 commit into
developfrom
fix/aikido-security-update-packages-51295289-4ipp

Conversation

@aikido-autofix

Copy link
Copy Markdown

Targeted updates to remediate security findings while preserving existing behavior

Upgrade httpclient to fix URI authority parsing vulnerability that could cause requests to be sent to unintended hosts.

✅ 1 CVE resolved by this upgrade

This PR will resolve the following CVEs:

Issue Severity           Description
CVE-2020-13956
MEDIUM
[httpclient] Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.

@aikido-autofix aikido-autofix Bot added the Kroo Label created by Aikido AutoFix label Jun 17, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Kroo Label created by Aikido AutoFix

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants