Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

square/okhttp

              main @ c467a32
            

Fixes

CVEs

HIGH

Peak severity

38.1%

Coverage

Highlights

Auth Bypass: 4 prior fixes. Scrutinize any change in this area.

okhttp/src/main/java/okhttp3/OkHttpClient.java: most-fixed (3 issues). Treat as high-risk during review.

18 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Hostname Verification Bypass: Multiple fixes target hostname verification, each addressing a distinct bypass vector (CN fallback, wildcard rules, IP canonicalization, Unicode normalization, malformed IPs). The verifier is a critical trust boundary; any residual gap in canonicalization or matching logic enables MITM.

Certificate Validation/Pinning Bypass: Chain cleaning and pinning were bypassed via partial chains, trusted-but-unpinned intermediates, substring hostname matching, and lack of chain normalization. These allow an attacker with a mis-issued certificate to pass validation or pinning.

Auth Bypass / Authentication Leak: Default authenticator was set to system default, risking credential leaks; request authenticator could leak into proxy auth; and Android chain cleaner equality ignored trustManager identity, allowing custom trust validation bypass.