Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-4e5q-x177-uyat
Vulnerability ID VCID-4e5q-x177-uyat
Aliases CVE-2021-0341
GHSA-3cqm-mf7h-prrj
Summary Square OkHttp can accept the wrong certificate In verifyHostName of OkHostnameVerifier.java, there is a possible way to accept a certificate for the wrong domain due to improperly used crypto. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11 Android ID: A-171980069
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-295 Improper Certificate Validation
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 7.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-0341.json
epss 0.01037 https://api.first.org/data/v1/epss?cve=CVE-2021-0341
epss 0.01037 https://api.first.org/data/v1/epss?cve=CVE-2021-0341
epss 0.01037 https://api.first.org/data/v1/epss?cve=CVE-2021-0341
epss 0.01037 https://api.first.org/data/v1/epss?cve=CVE-2021-0341
epss 0.01037 https://api.first.org/data/v1/epss?cve=CVE-2021-0341
epss 0.01037 https://api.first.org/data/v1/epss?cve=CVE-2021-0341
epss 0.01037 https://api.first.org/data/v1/epss?cve=CVE-2021-0341
epss 0.01037 https://api.first.org/data/v1/epss?cve=CVE-2021-0341
epss 0.01037 https://api.first.org/data/v1/epss?cve=CVE-2021-0341
epss 0.01037 https://api.first.org/data/v1/epss?cve=CVE-2021-0341
epss 0.01037 https://api.first.org/data/v1/epss?cve=CVE-2021-0341
epss 0.01037 https://api.first.org/data/v1/epss?cve=CVE-2021-0341
epss 0.01037 https://api.first.org/data/v1/epss?cve=CVE-2021-0341
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-3cqm-mf7h-prrj
cvssv3.1 7.5 https://github.com/square/okhttp
generic_textual HIGH https://github.com/square/okhttp
cvssv3.1 7.5 https://github.com/square/okhttp/commit/f574ea2f5259d9040f264ddeb582fb1ce563f10c
generic_textual HIGH https://github.com/square/okhttp/commit/f574ea2f5259d9040f264ddeb582fb1ce563f10c
cvssv3.1 7.5 https://github.com/square/okhttp/issues/6724
generic_textual HIGH https://github.com/square/okhttp/issues/6724
cvssv3.1 7.5 https://github.com/square/okhttp/pull/6741
generic_textual HIGH https://github.com/square/okhttp/pull/6741
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2021-0341
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2021-0341
cvssv3.1 7.5 https://source.android.com/security/bulletin/2021-02-01
generic_textual HIGH https://source.android.com/security/bulletin/2021-02-01
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-0341.json
https://api.first.org/data/v1/epss?cve=CVE-2021-0341
https://github.com/square/okhttp
https://github.com/square/okhttp/commit/f574ea2f5259d9040f264ddeb582fb1ce563f10c
https://github.com/square/okhttp/issues/6724
https://github.com/square/okhttp/pull/6741
https://nvd.nist.gov/vuln/detail/CVE-2021-0341
https://source.android.com/security/bulletin/2021-02-01
2154086 https://bugzilla.redhat.com/show_bug.cgi?id=2154086
GHSA-3cqm-mf7h-prrj https://github.com/advisories/GHSA-3cqm-mf7h-prrj
RHSA-2023:0756 https://access.redhat.com/errata/RHSA-2023:0756
RHSA-2023:2705 https://access.redhat.com/errata/RHSA-2023:2705
RHSA-2023:2706 https://access.redhat.com/errata/RHSA-2023:2706
RHSA-2023:2707 https://access.redhat.com/errata/RHSA-2023:2707
RHSA-2023:2710 https://access.redhat.com/errata/RHSA-2023:2710
RHSA-2023:2713 https://access.redhat.com/errata/RHSA-2023:2713
RHSA-2023:2723 https://access.redhat.com/errata/RHSA-2023:2723
RHSA-2023:3223 https://access.redhat.com/errata/RHSA-2023:3223
RHSA-2024:6667 https://access.redhat.com/errata/RHSA-2024:6667
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-0341.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/square/okhttp
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/square/okhttp/commit/f574ea2f5259d9040f264ddeb582fb1ce563f10c
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/square/okhttp/issues/6724
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/square/okhttp/pull/6741
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2021-0341
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://source.android.com/security/bulletin/2021-02-01
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.77343
EPSS Score 0.01037
Published At April 1, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T13:08:42.100249+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-3cqm-mf7h-prrj/GHSA-3cqm-mf7h-prrj.json 38.0.0