CVE-2026-71290CWE-295

CVE-2026-71290

Critical · published August 12, 2026

CVSS v3.1
9.1
EPSS
0%
Percentile
25.0
In the wild
Unconfirmed
What it is

Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicy#BUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonate the server by presenting a valid certificate for a different domain.

Please note the classic version of HttpClient is not affected by this vulnerability.

Affected users are recommended to upgrade to at least version 5.6.4, which fixes the issue.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00331 · 25.0th percentile
Weakness
CWE-295 · Improper Certificate Validation
Published
2026-08-12T01:17Z
Affected products (1)
ProductVersionsFixed in
apache/httpclient≥ 5.4, < 5.6.45.6.4
References (2)
https://lists.apache.org/thread/bhf7g2zwpom2ohvwjjjlonc93br2s8vq · [email protected]http://www.openwall.com/lists/oss-security/2026/08/13/6 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 11 AUG 20:33Z
    Apache HttpComponents Client: TLS hostname verification silently disabled on the async transport (default config, MITM)
    cvelistv5