Critical severity · published Aug 11, 2026
CVE-2026-71290
Apache HttpComponents Client: TLS hostname verification silently disabled on the async transport (default config, MITM)
9.1
CVSS
0.3%
EPSS
No
On KEV
Description
Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicy#BUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonate the server by presenting a valid certificate for a different domain.
Please note the classic version of HttpClient is not affected by this vulnerability.
Affected users are recommended to upgrade to at least version 5.6.4, which fixes the issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AH
Apache HttpComponents Client · Apache Software Foundation
5.4-alpha through 5.6.3 · source: vendor
HT
Httpclient · Apache
5.4 before 5.6.4 · source: NVD
Affected product
AH
Apache HttpComponents Client
Apache Software Foundation
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-71290
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-71290
Mailing List
https://lists.apache.org/thread/bhf7g2zwpom2ohvwjjjlonc93br2s8vq
Mailing List
http://www.openwall.com/lists/oss-security/2026/08/13/6
More from Apache HttpComponents Client
5.3
CVE-2026-64607
Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS