From the httpclient release notes for version 4.1.1 :
[HTTPCLIENT-1061] Fixed critical bug causing Proxy-Authorization header to be
sent to the target host when tunneling requests through a proxy server that
Created httpcomponents-client tracking bugs for this issue
Affects: fedora-15 [bug 709532]
FC16 has 4.1.2, F17 has 4.1.3, and this is fixed in upstream 4.1.1 release.