Apache Httpcomponents Client
Monthly
Server-impersonation via broken TLS hostname verification affects Apache HttpComponents Client 5.4 through 5.6.3 when applications use the asynchronous HttpClient, where the HostnameVerificationPolicy#BUILTIN setting is silently ignored. An adversary positioned to intercept and modify network traffic can present a valid certificate issued for an unrelated domain and the async client will accept it, defeating the core TLS server-identity check and exposing transmitted data. There is no public exploit identified at time of analysis and EPSS is very low (0.09%), but the CVSS base score is 9.1 and the classic (synchronous) HttpClient is explicitly unaffected.
Denial of service in Apache HttpComponents Client (versions 5.0-alpha1 through 5.6.2) arises when the classic/blocking I/O HttpClient fails to release the underlying connection back to the pool after receiving a response carrying an invalid or unsupported Content-Encoding header. An attacker who controls or can influence the server a client talks to can repeatedly return such headers to leak connections until the pool is exhausted, halting further outbound HTTP requests from the affected Java application. The async I/O HttpClient is explicitly unaffected; there is no public exploit identified at time of analysis and no CVSS or EPSS data was supplied.
Server-impersonation via broken TLS hostname verification affects Apache HttpComponents Client 5.4 through 5.6.3 when applications use the asynchronous HttpClient, where the HostnameVerificationPolicy#BUILTIN setting is silently ignored. An adversary positioned to intercept and modify network traffic can present a valid certificate issued for an unrelated domain and the async client will accept it, defeating the core TLS server-identity check and exposing transmitted data. There is no public exploit identified at time of analysis and EPSS is very low (0.09%), but the CVSS base score is 9.1 and the classic (synchronous) HttpClient is explicitly unaffected.
Denial of service in Apache HttpComponents Client (versions 5.0-alpha1 through 5.6.2) arises when the classic/blocking I/O HttpClient fails to release the underlying connection back to the pool after receiving a response carrying an invalid or unsupported Content-Encoding header. An attacker who controls or can influence the server a client talks to can repeatedly return such headers to leak connections until the pool is exhausted, halting further outbound HTTP requests from the affected Java application. The async I/O HttpClient is explicitly unaffected; there is no public exploit identified at time of analysis and no CVSS or EPSS data was supplied.