Skip to main content

Apache HttpComponents Client EUVDEUVD-2026-56973

| CVE-2026-71290 CRITICAL
Improper Certificate Validation (CWE-295)
2026-08-11 apache GHSA-72q8-9rgw-5g6j
Apache Information Disclosure Apache Httpcomponents Client
9.1
CVSS 3.1 · Vendor: apache
Share

Severity by source

Vendor (apache) PRIMARY
9.1 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
vuln.today AI
7.4 HIGH

MITM interception position is required, so AC:H not AC:L; no auth or interaction needed (PR:N/UI:N); high confidentiality and integrity loss, no availability impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
SUSE
7.7 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Lifecycle Timeline

5
Analysis Updated
Aug 12, 2026 - 20:29 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Aug 12, 2026 - 20:22 vuln.today
cvss_changed
CVSS changed
Aug 12, 2026 - 20:22 NVD
9.1 (CRITICAL)
Analysis Generated
Aug 11, 2026 - 21:37 vuln.today
CVE Published
Aug 11, 2026 - 20:33 cve.org
HIGH

DescriptionCVE.org

Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicy#BUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonate the server by presenting a valid certificate for a different domain.

Please note the classic version of HttpClient is not affected by this vulnerability.

Affected users are recommended to upgrade to at least version 5.6.4, which fixes the issue.

Articles & Coverage 1

News 8 New Apache Vulnerabilities - 8 High Severity, No Public Exploits Aug 12, 2026

AnalysisAI

Server-impersonation via broken TLS hostname verification affects Apache HttpComponents Client 5.4 through 5.6.3 when applications use the asynchronous HttpClient, where the HostnameVerificationPolicy#BUILTIN setting is silently ignored. An adversary positioned to intercept and modify network traffic can present a valid certificate issued for an unrelated domain and the async client will accept it, defeating the core TLS server-identity check and exposing transmitted data. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Gain man-in-the-middle position on network
Delivery
Intercept client's outbound TLS handshake
Exploit
Present valid cert for different domain
Execution
Async client skips hostname check
Impact
Impersonate server, read and modify traffic
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires three concrete conditions: (1) the target application must use the asynchronous HttpClient (HttpAsyncClient) from HttpComponents Client 5.4-alpha through 5.6.3 - the classic synchronous client is not vulnerable; (2) TLS server identity must rely on the HostnameVerificationPolicy#BUILTIN setting, which is silently ineffective on the async path; and (3) the attacker must occupy an active man-in-the-middle position able to intercept AND modify traffic between client and server, and must possess a certificate that is otherwise valid (chains to a trusted CA) but issued for a different domain. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The signals are mixed and should be read together rather than in isolation: the CVSS 3.1 score is a high 9.1 driven by network vector and dual High confidentiality/integrity impact (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), yet EPSS is only 0.09% (1st percentile), there is no CISA KEV listing, and no public proof-of-concept has surfaced, so this is not evidence of widespread active exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario A user's JVM application built on HttpComponents async HttpClient connects over HTTPS to a backend API from a coffee-shop or corporate-guest network; an attacker on that network (ARP spoofing, rogue AP, or upstream tap) intercepts the connection and presents a certificate that is valid but issued for an attacker-controlled domain. Because BUILTIN hostname verification is ignored on the async path, the client completes the TLS handshake and sends its request to the attacker, who can read and alter the data before relaying it. …
Remediation Vendor-released patch: upgrade Apache HttpComponents Client to at least version 5.6.4, which fixes the async hostname-verification defect, per the Apache advisory at https://lists.apache.org/thread/bhf7g2zwpom2ohvwjjjlonc93br2s8vq. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, inventory all applications using Apache HttpComponents Client versions 5.4-5.6.3 and identify those using AsyncHttpClient, prioritizing services handling authentication or sensitive data. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Apache Httpcomponents Client

View all
CVE-2026-64607 MEDIUM
5.3 Jul 31

Denial of service in Apache HttpComponents Client (versions 5.0-alpha1 through 5.6.2) arises when the classic/blocking I

Same weakness CWE-295 – Improper Certificate Validation

View all
CVE-2015-3152 MEDIUM POC
5.9
CVE-2017-2800 CRITICAL POC
9.8
CVE-2014-1266 HIGH POC
7.4
CVE-2022-47758 CRITICAL POC
9.8
CVE-2025-68121 CRITICAL POC
10.0
CVE-2025-29331 CRITICAL POC
9.8
CVE-2025-32878 CRITICAL POC
9.8
CVE-2024-3738 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Development Tools 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Server 16.0 Affected

Share

EUVD-2026-56973 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy