VRT 391,192 CVEs tracked · 15,442 in RASP scope · data as of 18 hours ago

CVE-2016-2402

5.9 Medium No exploit published

Description

OkHttp before 2.7.4 and 3.x before 3.1.2 allows man-in-the-middle attackers to bypass certificate pinning by sending a certificate chain with a certificate from a non-pinned trusted CA and the pinned certificate.

CWE-295

Exploitation Status

Proof of concept only

A proof of concept exists, but no reviewed exploit catalogue carries this CVE. Demonstrating a defect and weaponising it are different amounts of work.

CVSS E:P

  • CISA KEV not listed
  • CISA Vulnrichment no assessment published
  • Indexed PoC 2 indexed Published artifacts you can open, in GitHub PoC; first seen 2016-03-20.
  • EPSS 2.2% chance in 30 days
IndexArtifactStarsFirst seen
GitHub PoC Simple script for testing CVE-2016-2402 and similar flaws 13 2016-03-20
GitHub PoC OkHttp sample app vulnerable to CVE-2016-2402 10 2016-03-30

Waratek Defense Posture

No exploit published

In RASP's scope with an upstream fix path, but nobody has published a working exploit. That is a statement about what has been published, not a finding that the defect is unreachable or unimportant.

  • Protection none
  • Action unverified patch rule
  • Review automated upstream-data
  • Record active
Decided by no-exploit-published : A published working exploit for this candidate, not only a proof of concept, a forecast, or nothing at all
Finding This CVE is not listed in CISA KEV, CISA Vulnrichment records no active exploitation, and no reviewed exploit catalogue carries an entry for it. Nobody has published something a stranger can run, so it is not a candidate for a rule ahead of the ones where somebody has; an upstream fix path does exist, so the remediation half of the candidacy still holds. This is a statement about what has been published, not about whether the defect is reachable or serious.

CVSS

5.9 MEDIUM v3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N 2 metrics

VRT selects the newest version's highest entry and publishes it as cvssScore, newest rather than largest because scores are not comparable across versions, and highest rather than first because the first entry is frequently a CNA placeholder scoring 0.0 over NVD's own analysis.

VersionScoreBandVectorAssignerType
CVSS 3.1 5.9 MEDIUM CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N NVD Primary published
CVSS 2.0 4.3 no band published AV:N/AC:M/Au:N/C:N/I:P/A:N NVD Primary

Affected Software & Releases

☕ Maven Library Packages

Artifact coordinates and fix boundaries from OSV.dev
Package CoordinateIntroducedFixedLast affected
com.squareup.okhttp3:okhttp 0 2.7.4 unbounded
com.squareup.okhttp3:okhttp 3.0.0 3.1.2 unbounded

🖥️ Product CPEs & Version Ranges

3 product(s) over 8 version claims (uncapped)
SourceVendorProductSchemeAffected Versions
osv com.squareup.okhttp3 okhttp generic ＜ 2.7.4 · ≥ 3.0.0 and ＜ 3.1.2
nvd squareup okhttp generic ≤ 2.7.3
nvd squareup okhttp3 generic 3.0.0 · 3.0.0:rc1 · 3.0.1 · 3.1.0 · 3.1.1

References

URLTags
https://github.com/square/okhttp PACKAGE
https://koz.io/pinning-cve-2016-2402 WEB
https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E WEB
https://publicobject.com/2016/02/11/okhttp-certificate-pinning-vulnerability WEB
http://www.openwall.com/lists/oss-security/2016/02/10/8 WEB
http://www.openwall.com/lists/oss-security/2016/02/18/7 WEB
https://koz.io/pinning-cve-2016-2402/ Technical Description, Third Party Advisory
https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E
https://publicobject.com/2016/02/11/okhttp-certificate-pinning-vulnerability/ Vendor Advisory

Timeline

Published 2017-01-30 Last modified 2026-06-17
Published2017-01-30By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.