# Vulnerability CVE-2020-13956 reported on Elasticsearch 7.17.4
**URL:** https://discuss.elastic.co/t/vulnerability-cve-2020-13956-reported-on-elasticsearch-7-17-4/306854
**Category:** Elasticsearch
**Created:** [June 10, 2022, 8:14am UTC](https://discuss.elastic.co/t/vulnerability-cve-2020-13956-reported-on-elasticsearch-7-17-4/306854 "2022-06-10T08:14:11Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@sbrunot](https://discuss.elastic.co/u/sbrunot)
#### Post date: [June 10, 2022, 8:14am UTC](https://discuss.elastic.co/t/vulnerability-cve-2020-13956-reported-on-elasticsearch-7-17-4/306854/1 "2022-06-10T08:14:11Z")
Hello,
vulnerability CVE-2020-13956 is reported on the httpclient-4.5.10.jar libraries of the reindex module of Elasticsearch (modules/reindex/httpclient-4.5.10.jar).
Are there any official statements regarding if this vulnerability does indeed apply to Elasticsearch 7.17.4, or any plan to upgrade httpclient to a version that does not have the vulnerability ?
If not, is there any way that I can help upgrading this dependency to a higher version ?
Thanks for your help on this.
---
### Author:  [@ikakavas](https://discuss.elastic.co/u/ikakavas)
#### Post date: [June 10, 2022, 2:15pm UTC](https://discuss.elastic.co/t/vulnerability-cve-2020-13956-reported-on-elasticsearch-7-17-4/306854/2 "2022-06-10T14:15:28Z")
Thank you for your report.
Elastic's security reporting guidelines are available at [Security issues | Elastic](https://www.elastic.co/community/security).
Per those guidelines, all reports of potential security issues or vulnerabilities should be sent via email to [security@elastic.co](mailto:security@elastic.co).
We are unable to discuss potential issues of this nature here. Please send your report to the email address above, where it can be appropriately handled.
---
### Author:  [@sbrunot](https://discuss.elastic.co/u/sbrunot)
#### Post date: [June 13, 2022, 7:37am UTC](https://discuss.elastic.co/t/vulnerability-cve-2020-13956-reported-on-elasticsearch-7-17-4/306854/3 "2022-06-13T07:37:04Z")
I've sent an email to [security@elastic.co](mailto:security@elastic.co), thank you @ikakavas.
---
### Author:  [@sbrunot](https://discuss.elastic.co/u/sbrunot)
#### Post date: [June 20, 2022, 8:43am UTC](https://discuss.elastic.co/t/vulnerability-cve-2020-13956-reported-on-elasticsearch-7-17-4/306854/4 "2022-06-20T08:43:00Z")
Hi @ikakavas. I didn't get any answer to my email to [security@elastic.co](mailto:security@elastic.co). Are there any other communication channel that can be used to discuss this type of topics ?
---
### Author:  [@ikakavas](https://discuss.elastic.co/u/ikakavas)
#### Post date: [June 20, 2022, 9:11am UTC](https://discuss.elastic.co/t/vulnerability-cve-2020-13956-reported-on-elasticsearch-7-17-4/306854/5 "2022-06-20T09:11:20Z")
> [@sbrunot](#):
>
> Are there any other communication channel that can be used to discuss this type of topics ?
No. There is a queue and you will get an answer as soon as possible. If this is urgent on your side, please engage through your support engineer. Thank you for your patience.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 18, 2022, 9:11am UTC](https://discuss.elastic.co/t/vulnerability-cve-2020-13956-reported-on-elasticsearch-7-17-4/306854/6 "2022-07-18T09:11:59Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.