diff --git a/hadoop-mapreduce-project/CHANGES.txt b/hadoop-mapreduce-project/CHANGES.txt
index 0dc242e037d..c47ff84768e 100644
--- a/hadoop-mapreduce-project/CHANGES.txt
+++ b/hadoop-mapreduce-project/CHANGES.txt
@@ -160,6 +160,9 @@ Release 0.23.3 - UNRELEASED
 
     MAPREDUCE-4010.  TestWritableJobConf fails on trunk (tucu via bobby)
 
+    MAPREDUCE-3992. Reduce fetcher doesn't verify HTTP status code of response
+    (todd)
+
 Release 0.23.2 - UNRELEASED
 
   INCOMPATIBLE CHANGES
diff --git a/hadoop-mapreduce-project/hadoop-mapreduce-client/hadoop-mapreduce-client-core/src/main/java/org/apache/hadoop/mapreduce/task/reduce/Fetcher.java b/hadoop-mapreduce-project/hadoop-mapreduce-client/hadoop-mapreduce-client-core/src/main/java/org/apache/hadoop/mapreduce/task/reduce/Fetcher.java
index 93200873d6b..f3e7fd61c27 100644
--- a/hadoop-mapreduce-project/hadoop-mapreduce-client/hadoop-mapreduce-client-core/src/main/java/org/apache/hadoop/mapreduce/task/reduce/Fetcher.java
+++ b/hadoop-mapreduce-project/hadoop-mapreduce-client/hadoop-mapreduce-client-core/src/main/java/org/apache/hadoop/mapreduce/task/reduce/Fetcher.java
@@ -23,6 +23,7 @@
 import java.io.OutputStream;
 import java.net.MalformedURLException;
 import java.net.URL;
+import java.net.HttpURLConnection;
 import java.net.URLConnection;
 import java.util.HashSet;
 import java.util.List;
@@ -204,7 +205,7 @@ private void copyFromHost(MapHost host) throws IOException {
     
     try {
       URL url = getMapOutputURL(host, maps);
-      URLConnection connection = url.openConnection();
+      HttpURLConnection connection = (HttpURLConnection)url.openConnection();
       
       // generate hash of the url
       String msgToEncode = SecureShuffleUtils.buildMsgFrom(url);
@@ -218,6 +219,14 @@ private void copyFromHost(MapHost host) throws IOException {
       connect(connection, connectionTimeout);
       connectSucceeded = true;
       input = new DataInputStream(connection.getInputStream());
+
+      // Validate response code
+      int rc = connection.getResponseCode();
+      if (rc != HttpURLConnection.HTTP_OK) {
+        throw new IOException(
+            "Got invalid response code " + rc + " from " + url +
+            ": " + connection.getResponseMessage());
+      }
       
       // get the replyHash which is HMac of the encHash we sent to the server
       String replyHash = connection.getHeaderField(SecureShuffleUtils.HTTP_HEADER_REPLY_URL_HASH);