Skip to main content

Apache HttpComponents Client CVE-2026-71290

| EUVDEUVD-2026-56973 CRITICAL
Improper Certificate Validation (CWE-295)
2026-08-11 apache GHSA-72q8-9rgw-5g6j
Apache Information Disclosure Apache Httpcomponents Client Apache Software Foundation
9.1
CVSS 3.1 · Vendor: apache
Share

Severity by source

Vendor (apache) PRIMARY
9.1 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
ENISA EUVD
HIGH
qualitative
vuln.today AI
7.4 HIGH

MITM interception position is required, so AC:H not AC:L; no auth or interaction needed (PR:N/UI:N); high confidentiality and integrity loss, no availability impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
SUSE
7.7 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
Red Hat
8.1 HIGH
qualitative

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Lifecycle Timeline

5
Analysis Updated
Aug 12, 2026 - 20:29 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Aug 12, 2026 - 20:22 vuln.today
cvss_changed
CVSS changed
Aug 12, 2026 - 20:22 NVD
9.1 (CRITICAL)
Analysis Generated
Aug 11, 2026 - 21:37 vuln.today
CVE Published
Aug 11, 2026 - 20:33 cve.org
HIGH

DescriptionCVE.org

Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicy#BUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonate the server by presenting a valid certificate for a different domain.

Please note the classic version of HttpClient is not affected by this vulnerability.

Affected users are recommended to upgrade to at least version 5.6.4, which fixes the issue.

Articles & Coverage 1

News 8 New Apache Vulnerabilities - 8 High Severity, No Public Exploits Aug 12, 2026

AnalysisAI

Server-impersonation via broken TLS hostname verification affects Apache HttpComponents Client 5.4 through 5.6.3 when applications use the asynchronous HttpClient, where the HostnameVerificationPolicy#BUILTIN setting is silently ignored. An adversary positioned to intercept and modify network traffic can present a valid certificate issued for an unrelated domain and the async client will accept it, defeating the core TLS server-identity check and exposing transmitted data. There is no public exploit identified at time of analysis and EPSS is very low (0.09%), but the CVSS base score is 9.1 and the classic (synchronous) HttpClient is explicitly unaffected.

Technical ContextAI

Apache HttpComponents Client is a widely embedded Java HTTP library used by countless JVM applications and frameworks to make outbound HTTPS calls. TLS hostname verification (the root-cause class CWE-295, Improper Certificate Validation) is the step that binds a presented X.509 certificate to the hostname the client intended to reach; without it, a certificate that is cryptographically valid but issued for a different domain will still be trusted. In the affected releases the HostnameVerificationPolicy#BUILTIN mode - which is meant to enforce the library's built-in hostname matching - has no effect on the async transport path (HttpAsyncClient), so the async client establishes TLS sessions without confirming that the certificate's subject/SAN matches the target host. The CPE cpe:2.3:a:apache_software_foundation:apache_httpcomponents_client covers the affected package, and per the EUVD data the impacted range is 5.4-alpha through 5.6.3.

RemediationAI

Vendor-released patch: upgrade Apache HttpComponents Client to at least version 5.6.4, which fixes the async hostname-verification defect, per the Apache advisory at https://lists.apache.org/thread/bhf7g2zwpom2ohvwjjjlonc93br2s8vq. Because the flaw is confined to the asynchronous HttpClient, an interim option for applications that do not strictly require async I/O is to route sensitive outbound HTTPS through the unaffected classic HttpClient until the upgrade lands. If upgrading cannot be done immediately, restrict async-client traffic to trusted network paths (for example pin outbound calls through a controlled egress proxy or VPN and avoid untrusted/public networks), and consider adding an explicit application-level hostname/certificate check or certificate pinning on the async connections; the trade-off is added configuration and maintenance overhead and potential breakage when legitimate certificates rotate. Upgrading to 5.6.4 remains the only complete fix and should not be deferred.

More in Apache Httpcomponents Client

View all
CVE-2026-64607 MEDIUM
5.3 Jul 31

Denial of service in Apache HttpComponents Client (versions 5.0-alpha1 through 5.6.2) arises when the classic/blocking I

Same weakness CWE-295 – Improper Certificate Validation

View all
CVE-2026-85102 CRITICAL POC
9.8
CVE-2015-3152 MEDIUM POC
5.9
CVE-2017-2800 CRITICAL POC
9.8
CVE-2014-1266 HIGH POC
7.4
CVE-2022-47758 CRITICAL POC
9.8
CVE-2025-68121 CRITICAL POC
10.0
CVE-2025-29331 CRITICAL POC
9.8
CVE-2025-32878 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Development Tools 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Server 16.0 Affected

Share

CVE-2026-71290 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy