Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Apache HttpClient5 may let attackers run code
published 12 days ago
Summary
The Apache HttpClient5 libraries (including client, cache, fluent, parent and testing modules) contain a weakness that could allow an attacker to execute malicious code on the server using the library. Updating to version 5.1.4‑tuxcare.1 removes this risk. Apply the provided update as soon as possible to keep your applications safe.
What to do
- Update apache org.apache.httpcomponents.client5:httpclient5 to version 5.1.4-tuxcare.1.
- Update apache org.apache.httpcomponents.client5:httpclient5-cache to version 5.1.4-tuxcare.1.
- Update apache org.apache.httpcomponents.client5:httpclient5-fluent to version 5.1.4-tuxcare.1.
- Update apache org.apache.httpcomponents.client5:httpclient5-parent to version 5.1.4-tuxcare.1.
- Update apache org.apache.httpcomponents.client5:httpclient5-testing to version 5.1.4-tuxcare.1.
- Update apache org.apache.httpcomponents.client5:httpclient5-win to version 5.1.4-tuxcare.1.
- Update org.apache.httpcomponents.client5:httpclient5 to version 5.1.4-tuxcare.1.
- Update org.apache.httpcomponents.client5:httpclient5-cache to version 5.1.4-tuxcare.1.
- Update org.apache.httpcomponents.client5:httpclient5-fluent to version 5.1.4-tuxcare.1.
- Update org.apache.httpcomponents.client5:httpclient5-testing to version 5.1.4-tuxcare.1.
- Update org.apache.httpcomponents.client5:httpclient5-win to version 5.1.4-tuxcare.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:Maven | apache | org.apache.httpcomponents.client5:httpclient5 |
>= 5.1.4, < 5.1.4-tuxcare.1 Fix: upgrade to 5.1.4-tuxcare.1
|
| TuxCare:Maven | apache | org.apache.httpcomponents.client5:httpclient5-cache |
>= 5.1.4, < 5.1.4-tuxcare.1 Fix: upgrade to 5.1.4-tuxcare.1
|
| TuxCare:Maven | apache | org.apache.httpcomponents.client5:httpclient5-fluent |
>= 5.1.4, < 5.1.4-tuxcare.1 Fix: upgrade to 5.1.4-tuxcare.1
|
| TuxCare:Maven | apache | org.apache.httpcomponents.client5:httpclient5-parent |
>= 5.1.4, < 5.1.4-tuxcare.1 Fix: upgrade to 5.1.4-tuxcare.1
|
| TuxCare:Maven | apache | org.apache.httpcomponents.client5:httpclient5-testing |
>= 5.1.4, < 5.1.4-tuxcare.1 Fix: upgrade to 5.1.4-tuxcare.1
|
| TuxCare:Maven | apache | org.apache.httpcomponents.client5:httpclient5-win |
>= 5.1.4, < 5.1.4-tuxcare.1 Fix: upgrade to 5.1.4-tuxcare.1
|
| TuxCare:Maven | – | org.apache.httpcomponents.client5:httpclient5 |
>= 5.1.4, < 5.1.4-tuxcare.1 Fix: upgrade to 5.1.4-tuxcare.1
|
| TuxCare:Maven | – | org.apache.httpcomponents.client5:httpclient5-cache |
>= 5.1.4, < 5.1.4-tuxcare.1 Fix: upgrade to 5.1.4-tuxcare.1
|
| TuxCare:Maven | – | org.apache.httpcomponents.client5:httpclient5-fluent |
>= 5.1.4, < 5.1.4-tuxcare.1 Fix: upgrade to 5.1.4-tuxcare.1
|
| TuxCare:Maven | – | org.apache.httpcomponents.client5:httpclient5-testing |
>= 5.1.4, < 5.1.4-tuxcare.1 Fix: upgrade to 5.1.4-tuxcare.1
|
| TuxCare:Maven | – | org.apache.httpcomponents.client5:httpclient5-win |
>= 5.1.4, < 5.1.4-tuxcare.1 Fix: upgrade to 5.1.4-tuxcare.1
|
Original advisory text
TuxCare security update for org.apache.httpcomponents.client5:httpclient5 (1 CVE)
TuxCare rebuilt org.apache.httpcomponents.client5:httpclient5 to address 1 CVE. Fixed in 5.1.4-tuxcare.1.
Timeline
Published23 Oct 2026
Updated2 Nov 2026
First seen23 Oct 2026
Sources
CLSA-2026-1792743499 · OSV
Track software like this
Free during beta