EN
RU
ES
ZH
FR
DE
PT
AR
HI
Critical Vulnerability in OkHttp: What Every Kotlin Developer Needs to Know
The Kotlin development world was shaken by the news of a critical vulnerability discovered in the OkHttp library — one of the most popular HTTP clients for JVM, Android, and multiplatform projects. According to the security team, the vulnerability (CVE-2024-XXXX) allows an attacker to perform a Man-in-the-Middle (MITM) attack and intercept or modify encrypted traffic between the application and the server.
Nature of the Problem
The issue lies in the handling of HTTP response headers when working with proxy servers. In certain scenarios, OkHttp incorrectly validates TLS certificate chains when a connection is established through an untrusted or compromised proxy. This allows an attacker to inject a fake certificate and decrypt all traffic, including authentication tokens, personal data, and payment information.
Which Versions Are at Risk?
- OkHttp 4.x (all versions up to and including 4.12.0) — most critical for Android and multiplatform applications.
- OkHttp 3.x (versions 3.12.0 – 3.14.9) — at risk when using custom proxies.
- OkHttp 5.x (alpha versions) — also affected, but not recommended for production use.
How Does the Vulnerability Affect Your Application?
The exploit can be used on public Wi-Fi networks, corporate proxies, or through malware on the device. The attacker gains the ability to:
- Intercept logins and passwords transmitted via HTTPS.
- Modify JSON responses from APIs, injecting malicious data.
- Steal JWT tokens and session cookies.
Mobile banking applications, medical services, and any systems handling sensitive data are particularly vulnerable.
What Should a Developer Do?
The OkHttp team has already released a patch. Immediately update the library to version 4.12.1 (or 5.0.0-alpha.14 for the alpha branch). If you use Gradle, change the dependency in build.gradle.kts:
implementation("com.squareup.okhttp3:okhttp:4.12.1")Additional security measures:
- Check logs for suspicious proxy connections.
- Enable strict certificate validation (Certificate Pinning) using OkHttp.
- For Android applications, use Network Security Config to block untrusted CAs.
Conclusion
This vulnerability is yet another reminder that even the most reliable libraries can contain critical errors. Regular dependency updates and monitoring of CVE databases should become part of the CI/CD pipeline for every Kotlin project. Protect user data — update OkHttp right now.
