CVE-2026-71290
Apache HttpComponents Client: TLS hostname verification silently disabled on the async transport (default config, MITM)
Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicy#BUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonate the server by presenting a valid certificate for a different domain.
Please note the classic version of HttpClient is not affected by this vulnerability.
Affected users are recommended to upgrade to at least version 5.6.4, which fixes the issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Apache HttpComponents Client: TLS hostname verification silently disabled on the async transport (default config, MITM)
Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicy#BUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonate the server by presenting a valid certificate for a different domain.
Please note the classic version of HttpClient is not affected by this vulnerability.
Affected users are recommended to upgrade to at least version 5.6.4, which fixes the issue.
- Record
CVE-2026-71290- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-295
- Updated
- 2026-11-02
EUVDEUVD-2026-56973
Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicy#BUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonate the server by presenting a valid certificate for a different domain.
Please note the classic version of HttpClient is not affected by this vulnerability.
Affected users are recommended to upgrade to at least version 5.6.4, which fixes the issue.
- Record
EUVD-2026-56973- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-72q8-9rgw-5g6j
Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer....
Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicy#BUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonate the server by presenting a valid certificate for a different domain.
Please note the classic version of HttpClient is not affected by this vulnerability.
Affected users are recommended to upgrade to at least version 5.6.4, which fixes the issue.
- Record
GHSA-72q8-9rgw-5g6j- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-295
- Updated
- 2026-11-02
NVD
Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicy#BUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonate the server by presenting a valid certificate for a different domain.
Please note the classic version of HttpClient is not affected by this vulnerability.
Affected users are recommended to upgrade to at least version 5.6.4, which fixes the issue.
- Record
CVE-2026-71290- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-295
- Updated
- 2026-11-02
OSV
Apache HttpComponents Client: TLS hostname verification silently disabled on the async transport (default config, MITM)
Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicy#BUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonate the server by presenting a valid certificate for a different domain.
Please note the classic version of HttpClient is not affected by this vulnerability.
Affected users are recommended to upgrade to at least version 5.6.4, which fixes the issue.
- Record
CVE-2026-71290- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-295
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-71290
Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicy#BUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonate the server by presenting a valid certificate for a different domain. Please note the classic version of HttpClient is not affected by this vulnerability. Affected users are recommended to upgrade to at least version 5.6.4, which fixes the issue.
- Record
DEBIAN-CVE-2026-71290- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
Show 6 moreShow less
OSVRHLW-2026-32de0f514c232ff5
Lightwell Security Advisory: httpclient5 5.6.2.rhlw-00005
Red Hat Lightwell has released org.apache.httpcomponents.client5:httpclient5 5.6.2.rhlw-00005 with backported fixes for CVE-2026-64607 and CVE-2026-71290.
CVE-2026-64607: Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS
CVE-2026-71290: Apache HttpComponents Client: TLS hostname verification silently disabled on the async transport (default config, MITM)
This patched artifact is a drop-in replacement for org.apache.httpcomponents.client5:httpclient5 5.6.2 from Maven Central.
- Record
RHLW-2026-32de0f514c232ff5- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVRHLW-2026-639f255bd180ae78
Lightwell Security Advisory: httpclient5 5.6.1.rhlw-00026
Red Hat Lightwell has released org.apache.httpcomponents.client5:httpclient5 5.6.1.rhlw-00026 with backported fixes for CVE-2026-64607 and CVE-2026-71290.
CVE-2026-64607: Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS
CVE-2026-71290: Apache HttpComponents Client: TLS hostname verification silently disabled on the async transport (default config, MITM)
This patched artifact is a drop-in replacement for org.apache.httpcomponents.client5:httpclient5 5.6.1 from Maven Central.
- Record
RHLW-2026-639f255bd180ae78- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-06
OSVRHLW-2026-e56fd5f91f882db9
Lightwell Security Advisory: httpclient5-cache 5.6.2.rhlw-00005
Red Hat Lightwell has released org.apache.httpcomponents.client5:httpclient5-cache 5.6.2.rhlw-00005 with a backported security fix.
CVE-2026-71290: Apache HttpComponents Client: TLS hostname verification silently disabled on the async transport (default config, MITM)
This patched artifact is a drop-in replacement for org.apache.httpcomponents.client5:httpclient5-cache 5.6.2 from Maven Central.
- Record
RHLW-2026-e56fd5f91f882db9- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-71290
Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicy#BUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonate the server by presenting a valid certificate for a different domain. Please note the classic version of HttpClient is not affected by this vulnerability. Affected users are recommended to upgrade to at least version 5.6.4, which fixes the issue.
- Record
UBUNTU-CVE-2026-71290- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVCLSA-2026-1787027808 No score
TuxCare security update for org.apache.httpcomponents.client5:httpclient5 (1 CVE)
TuxCare rebuilt org.apache.httpcomponents.client5:httpclient5 to address 1 CVE. Fixed in 5.5.2-tuxcare.2.
- Record
CLSA-2026-1787027808- Updated
- 2026-11-02
OSVCLSA-2026-1792745046 No score
TuxCare security update for org.apache.httpcomponents.client5:httpclient5 (2 CVEs)
TuxCare rebuilt org.apache.httpcomponents.client5:httpclient5 to address 2 CVEs. Fixed in 5.4.4-tuxcare.1.
- Record
CLSA-2026-1792745046- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.httpcomponents.client5:httpclient5TuxCare:Maven |
5.5.2 up to 5.5.2-tuxcare.2, plus listed versions 5.5.2-tuxcare.1 |
5.5.2-tuxcare.2 |
org.apache.httpcomponents.client5:httpclient5TuxCare:Maven From an advisory covering 2 CVEs |
5.4.4 up to 5.4.4-tuxcare.1 | 5.4.4-tuxcare.1 |
httpcomponents-core5Debian:14 |
All versions, plus listed versions 5.2.2-15.2.2-25.4-15.4.2-15.4.2-1.15.4.2-25.4.3-15.4.4-1 |
None known |
org.apache.httpcomponents.client5:httpclient5Red Hat Lightwell:Maven From an advisory covering 2 CVEs |
before 5.6.2.rhlw-00005, plus listed versions 5.05.0-alpha15.0-alpha25.0-alpha35.0-beta1 Show 41 moreShow less5.0-beta25.0-beta35.0-beta45.0-beta55.0-beta65.0-beta75.0.15.0.25.0.35.0.45.15.1-beta15.1.15.1.25.1.35.1.45.25.2-alpha15.2-beta15.2.15.2.25.2.35.35.3-alpha15.3.15.45.4-alpha15.4-alpha25.4-beta15.4.15.4.25.4.35.4.45.55.5-alpha15.5.15.5.25.65.6-alpha15.6.15.6.2 |
5.6.2.rhlw-00005 |
org.apache.httpcomponents.client5:httpclient5Red Hat Lightwell:Maven From an advisory covering 2 CVEs |
before 5.6.1.rhlw-00026, plus listed versions 5.05.0-alpha15.0-alpha25.0-alpha35.0-beta1 Show 40 moreShow less5.0-beta25.0-beta35.0-beta45.0-beta55.0-beta65.0-beta75.0.15.0.25.0.35.0.45.15.1-beta15.1.15.1.25.1.35.1.45.25.2-alpha15.2-beta15.2.15.2.25.2.35.35.3-alpha15.3.15.45.4-alpha15.4-alpha25.4-beta15.4.15.4.25.4.35.4.45.55.5-alpha15.5.15.5.25.65.6-alpha15.6.1 |
5.6.1.rhlw-00026 |
org.apache.httpcomponents.client5:httpclient5-cacheRed Hat Lightwell:Maven |
before 5.6.2.rhlw-00005, plus listed versions 5.05.0-alpha15.0-alpha25.0-alpha35.0-beta1 Show 41 moreShow less5.0-beta25.0-beta35.0-beta45.0-beta55.0-beta65.0-beta75.0.15.0.25.0.35.0.45.15.1-beta15.1.15.1.25.1.35.1.45.25.2-alpha15.2-beta15.2.15.2.25.2.35.35.3-alpha15.3.15.45.4-alpha15.4-alpha25.4-beta15.4.15.4.25.4.35.4.45.55.5-alpha15.5.15.5.25.65.6-alpha15.6.15.6.2 |
5.6.2.rhlw-00005 |
httpcomponents-core5Ubuntu:22.04:LTS |
All versions, plus listed versions 5.1.2-15.1.2-25.1.3-1 |
None known |
httpcomponents-core5Ubuntu:24.04:LTS |
All versions, plus listed versions 5.2.1-15.2.2-1 |
None known |
httpcomponents-core5Ubuntu:26.10 |
All versions, plus listed versions 5.4-15.4.2-1.15.4.3-1 |
None known |
httpcomponents-core5Ubuntu:26.04:LTS |
All versions, plus listed versions 5.2.2-15.2.2-25.4-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases | OSV | |
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-71290 is a critical vulnerability (CVSS 9.1) in Apache Httpclient, published August 11, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.33%, the 26th percentile. Fixed in org.apache.httpcomponents.client5:httpclient5 5.5.2-tuxcare.2.
References
lists.apache.org/thread/bhf7g2zwpom2ohvwjjjlonc93br2s8vq
openwall.com/lists/oss-security/2026/08/13/6
nvd.nist.gov/vuln/detail/CVE-2026-71290
github.com/advisories/GHSA-72q8-9rgw-5g6j
repo.maven.apache.org/maven2
Show 7 moreShow less
security-tracker.debian.org/tracker/CVE-2026-71290
ubuntu.com/security/CVE-2026-71290
cve.org/CVERecord?id=CVE-2026-71290