CVE-2011-1498
Exposure of Sensitive Information to an Unauthorized Actor in Apache HttpClient
CVE-2011-1498 is a medium vulnerability (CVSS 4.3) in Apache Httpclient, published July 7, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.69%, the 93rd percentile. Fixed in org.apache.httpcomponents:httpclient 4.1.1.
Apache HttpClient 4.x before 4.1.1 in Apache HttpComponents, when used with an authenticating proxy server, sends the Proxy-Authorization header to the origin server, which allows remote web servers to obtain sensitive information by logging this header.
Exploit likelihood
What each source reports
NVD Score used
Apache HttpClient 4.x before 4.1.1 in Apache HttpComponents, when used with an authenticating proxy server, sends the Proxy-Authorization header to the origin server, which allows remote web servers to obtain sensitive information by logging this header.
- Record
CVE-2011-1498- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE List No score
Apache HttpClient 4.x before 4.1.1 in Apache HttpComponents, when used with an authenticating proxy server, sends the Proxy-Authorization header to the origin server, which allows remote web servers to obtain sensitive information by logging this header.
- Record
CVE-2011-1498- Updated
- 2026-11-02
EUVDEUVD-2022-4023 No score
Apache HttpClient 4.x before 4.1.1 in Apache HttpComponents, when used with an authenticating proxy server, sends the Proxy-Authorization header to the origin server, which allows remote web servers to obtain sensitive information by logging this header.
- Record
EUVD-2022-4023- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-gw85-4gmf-m7rh No score
Exposure of Sensitive Information to an Unauthorized Actor in Apache HttpClient
Apache HttpClient 4.x before 4.1.1 in Apache HttpComponents, when used with an authenticating proxy server, sends the Proxy-Authorization header to the origin server, which allows remote web servers to obtain sensitive information by logging this header.
- Record
GHSA-gw85-4gmf-m7rh- Weakness
- CWE-200
- Updated
- 2026-11-02
OSV No score
Apache HttpClient 4.x before 4.1.1 in Apache HttpComponents, when used with an authenticating proxy server, sends the Proxy-Authorization header to the origin server, which allows remote web servers to obtain sensitive information by logging this header.
- Record
CVE-2011-1498- Updated
- 2026-11-02
OSVDEBIAN-CVE-2011-1498 No score
Apache HttpClient 4.x before 4.1.1 in Apache HttpComponents, when used with an authenticating proxy server, sends the Proxy-Authorization header to the origin server, which allows remote web servers to obtain sensitive information by logging this header.
- Record
DEBIAN-CVE-2011-1498- Updated
- 2026-11-02
OSVGHSA-gw85-4gmf-m7rh No score
Exposure of Sensitive Information to an Unauthorized Actor in Apache HttpClient
Apache HttpClient 4.x before 4.1.1 in Apache HttpComponents, when used with an authenticating proxy server, sends the Proxy-Authorization header to the origin server, which allows remote web servers to obtain sensitive information by logging this header.
- Record
GHSA-gw85-4gmf-m7rh- Weakness
- CWE-200
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.httpcomponents:httpclientMaven |
4.0.0 up to 4.1.1 | 4.1.1 |
httpcomponents-clientDebian:12 |
before 4.1.1-1 | 4.1.1-1 |
httpcomponents-clientDebian:13 |
before 4.1.1-1 | 4.1.1-1 |
httpcomponents-clientDebian:14 |
before 4.1.1-1 | 4.1.1-1 |
org.apache.httpcomponents:httpclientMaven |
4.0.0 up to 4.1.1, plus listed versions 4.04.0.14.0.24.0.34.14.1-alpha14.1-alpha24.1-beta1 |
4.1.1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
marc.info?l=httpclient-users&m=129853896315461&w=2
openwall.com/lists/oss-security/2011/04/08/1
bugzilla.redhat.com/show_bug.cgi?id=709531
Show 13 moreShow less
issues.apache.org/jira/browse/HTTPCLIENT-1061
kb.cert.org/vuls/id/153049
securityfocus.com/bid/46974
securityreason.com/securityalert/8298
lists.fedoraproject.org/pipermail/package-announce/2011-June/061440.html
apache.org/dist/httpcomponents/httpclient/RELEASE_NOTES-4.1.x.txt
nvd.nist.gov/vuln/detail/CVE-2011-1498
github.com/apache/httpcomponents-client/commit/a572756592c969affd0ce87885724e74839176fb
security-tracker.debian.org/tracker/CVE-2011-1498