{"id":"CVE-2026-71290","aliases":["CLSA-2026-1787027808","CLSA-2026-1792745046","DEBIAN-CVE-2026-71290","EUVD-2026-56973","GHSA-72q8-9rgw-5g6j","GHSA-hjcp-jmpx-g3qm","RHLW-2026-32de0f514c232ff5","RHLW-2026-639f255bd180ae78","RHLW-2026-e56fd5f91f882db9","UBUNTU-CVE-2026-71290"],"status":"published","title":"Apache HttpComponents Client: TLS hostname verification silently disabled on the async transport (default config, MITM)","description":"Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicy#BUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonate the server by presenting a valid certificate for a different domain. \n\n\nPlease note the classic version of HttpClient is not affected by this vulnerability. \n\nAffected users are recommended to upgrade to at least version 5.6.4, which fixes the issue.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00331,"percentile":0.26503,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-295"],"published":"2026-08-11T20:33:56Z","modified":"2026-11-06T19:30:03Z","fixes":[{"ecosystem":"TuxCare:Maven","package":"org.apache.httpcomponents.client5:httpclient5","fixed_in":["5.5.2-tuxcare.2"],"sources":["osv"]},{"ecosystem":"Red Hat Lightwell:Maven","package":"org.apache.httpcomponents.client5:httpclient5-cache","fixed_in":["5.6.2.rhlw-00005"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.httpcomponents.client5:httpclient5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.5.2"},{"fixed":"5.5.2-tuxcare.2"}]}],"versions":["5.5.2","5.5.2-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.httpcomponents.client5:httpclient5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.4.4"},{"fixed":"5.4.4-tuxcare.1"}]}],"versions":["5.4.4"],"bundled":2},{"source":"osv","ecosystem":"Debian:14","package":"httpcomponents-core5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.2.2-1","5.2.2-2","5.4-1","5.4.2-1","5.4.2-1.1","5.4.2-2","5.4.3-1","5.4.4-1"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.apache.httpcomponents.client5:httpclient5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.2.rhlw-00005"}]}],"versions":["5.0","5.0-alpha1","5.0-alpha2","5.0-alpha3","5.0-beta1","5.0-beta2","5.0-beta3","5.0-beta4","5.0-beta5","5.0-beta6","5.0-beta7","5.0.1","5.0.2","5.0.3","5.0.4","5.1","5.1-beta1","5.1.1","5.1.2","5.1.3","5.1.4","5.2","5.2-alpha1","5.2-beta1","5.2.1","5.2.2","5.2.3","5.3","5.3-alpha1","5.3.1","5.4","5.4-alpha1","5.4-alpha2","5.4-beta1","5.4.1","5.4.2","5.4.3","5.4.4","5.5","5.5-alpha1","5.5.1","5.5.2","5.6","5.6-alpha1","5.6.1","5.6.2"],"bundled":2},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.apache.httpcomponents.client5:httpclient5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.1.rhlw-00026"}]}],"versions":["5.0","5.0-alpha1","5.0-alpha2","5.0-alpha3","5.0-beta1","5.0-beta2","5.0-beta3","5.0-beta4","5.0-beta5","5.0-beta6","5.0-beta7","5.0.1","5.0.2","5.0.3","5.0.4","5.1","5.1-beta1","5.1.1","5.1.2","5.1.3","5.1.4","5.2","5.2-alpha1","5.2-beta1","5.2.1","5.2.2","5.2.3","5.3","5.3-alpha1","5.3.1","5.4","5.4-alpha1","5.4-alpha2","5.4-beta1","5.4.1","5.4.2","5.4.3","5.4.4","5.5","5.5-alpha1","5.5.1","5.5.2","5.6","5.6-alpha1","5.6.1"],"bundled":2},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.apache.httpcomponents.client5:httpclient5-cache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.2.rhlw-00005"}]}],"versions":["5.0","5.0-alpha1","5.0-alpha2","5.0-alpha3","5.0-beta1","5.0-beta2","5.0-beta3","5.0-beta4","5.0-beta5","5.0-beta6","5.0-beta7","5.0.1","5.0.2","5.0.3","5.0.4","5.1","5.1-beta1","5.1.1","5.1.2","5.1.3","5.1.4","5.2","5.2-alpha1","5.2-beta1","5.2.1","5.2.2","5.2.3","5.3","5.3-alpha1","5.3.1","5.4","5.4-alpha1","5.4-alpha2","5.4-beta1","5.4.1","5.4.2","5.4.3","5.4.4","5.5","5.5-alpha1","5.5.1","5.5.2","5.6","5.6-alpha1","5.6.1","5.6.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"httpcomponents-core5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.1.2-1","5.1.2-2","5.1.3-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"httpcomponents-core5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.2.1-1","5.2.2-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"httpcomponents-core5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4-1","5.4.2-1.1","5.4.3-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"httpcomponents-core5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.2.2-1","5.2.2-2","5.4-1"]}],"products":[{"vendor":"apache","product":"httpclient"},{"vendor":"apache software foundation","product":"apache httpcomponents client"}],"references":[{"url":"https://lists.apache.org/thread/bhf7g2zwpom2ohvwjjjlonc93br2s8vq","tags":["vendor-advisory","Mailing List","Release Notes","advisory","report"]},{"url":"http://www.openwall.com/lists/oss-security/2026/08/13/6","tags":["Mailing List","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71290","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-72q8-9rgw-5g6j"},{"url":"https://repo.maven.apache.org/maven2/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71290.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-71290","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64607.json","tags":["advisory"]},{"url":"https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64607","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-hjcp-jmpx-g3qm","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-71290","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-71290","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-71290","title":"Apache HttpComponents Client: TLS hostname verification silently disabled on the async transport (default config, MITM)","description":"Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicy#BUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonate the server by presenting a valid certificate for a different domain. \n\n\nPlease note the classic version of HttpClient is not affected by this vulnerability. \n\nAffected users are recommended to upgrade to at least version 5.6.4, which fixes the issue.","status":"published","published":"2026-08-11T20:33:56.947Z","modified":"2026-09-24T03:55:24.916Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"adp"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:19:49.559463Z"}],"euvd":[{"id":"EUVD-2026-56973","description":"Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicy#BUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonate the server by presenting a valid certificate for a different domain. \n\n\nPlease note the classic version of HttpClient is not affected by this vulnerability. \n\nAffected users are recommended to upgrade to at least version 5.6.4, which fixes the issue.","status":"published","published":"2026-08-11T20:33:56Z","modified":"2026-09-24T03:55:24Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T17:27:59.820483Z"}],"ghsa":[{"id":"GHSA-72q8-9rgw-5g6j","title":"Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer....","description":"Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicy#BUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and\n the server can impersonate the server by presenting a valid certificate\n for a different domain. \n\n\nPlease note the classic version of HttpClient is not affected by this vulnerability. \n\nAffected users are recommended to upgrade to at least version 5.6.4, which fixes the issue.","status":"published","published":"2026-08-11T21:33:12Z","modified":"2026-08-13T18:31:23Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T15:10:25.845105Z"}],"nvd":[{"id":"CVE-2026-71290","description":"Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicy#BUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonate the server by presenting a valid certificate for a different domain. \n\n\nPlease note the classic version of HttpClient is not affected by this vulnerability. \n\nAffected users are recommended to upgrade to at least version 5.6.4, which fixes the issue.","status":"published","published":"2026-08-11T21:17:51.157Z","modified":"2026-10-24T15:10:00.19Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"secondary"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:12:36.880938Z"}],"osv":[{"id":"CVE-2026-71290","title":"Apache HttpComponents Client: TLS hostname verification silently disabled on the async transport (default config, MITM)","description":"Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicy#BUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonate the server by presenting a valid certificate for a different domain. \n\n\nPlease note the classic version of HttpClient is not affected by this vulnerability. \n\nAffected users are recommended to upgrade to at least version 5.6.4, which fixes the issue.","status":"published","published":"2026-08-11T20:33:56.947Z","modified":"2026-10-28T02:30:34.684826322Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T15:45:15.164658Z"},{"id":"DEBIAN-CVE-2026-71290","description":"Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicy#BUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonate the server by presenting a valid certificate for a different domain.    Please note the classic version of HttpClient is not affected by this vulnerability.   Affected users are recommended to upgrade to at least version 5.6.4, which fixes the issue.","status":"published","published":"2026-08-11T21:17:51.157Z","modified":"2026-10-25T09:47:37.296220138Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:46:02.094661Z"},{"id":"RHLW-2026-32de0f514c232ff5","title":"Lightwell Security Advisory: httpclient5 5.6.2.rhlw-00005","description":"Red Hat Lightwell has released org.apache.httpcomponents.client5:httpclient5 5.6.2.rhlw-00005 with backported fixes for CVE-2026-64607 and CVE-2026-71290.\n\nCVE-2026-64607: Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS\n\nCVE-2026-71290: Apache HttpComponents Client: TLS hostname verification silently disabled on the async transport (default config, MITM)\n\nThis patched artifact is a drop-in replacement for org.apache.httpcomponents.client5:httpclient5 5.6.2 from Maven Central.","status":"published","published":"2026-10-08T00:00:00Z","modified":"2026-10-27T04:00:05.538251239Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHLW-2026-639f255bd180ae78","title":"Lightwell Security Advisory: httpclient5 5.6.1.rhlw-00026","description":"Red Hat Lightwell has released org.apache.httpcomponents.client5:httpclient5 5.6.1.rhlw-00026 with backported fixes for CVE-2026-64607 and CVE-2026-71290.\n\nCVE-2026-64607: Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS\n\nCVE-2026-71290: Apache HttpComponents Client: TLS hostname verification silently disabled on the async transport (default config, MITM)\n\nThis patched artifact is a drop-in replacement for org.apache.httpcomponents.client5:httpclient5 5.6.1 from Maven Central.","status":"published","published":"2026-11-03T11:05:42Z","modified":"2026-11-06T19:30:03.81897266Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-06T19:35:45.633414Z"},{"id":"RHLW-2026-e56fd5f91f882db9","title":"Lightwell Security Advisory: httpclient5-cache 5.6.2.rhlw-00005","description":"Red Hat Lightwell has released org.apache.httpcomponents.client5:httpclient5-cache 5.6.2.rhlw-00005 with a backported security fix.\n\nCVE-2026-71290: Apache HttpComponents Client: TLS hostname verification silently disabled on the async transport (default config, MITM)\n\nThis patched artifact is a drop-in replacement for org.apache.httpcomponents.client5:httpclient5-cache 5.6.2 from Maven Central.","status":"published","published":"2026-10-08T19:45:54Z","modified":"2026-10-27T04:00:18.155163892Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:52:59.135214Z"},{"id":"UBUNTU-CVE-2026-71290","description":"Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicy#BUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonate the server by presenting a valid certificate for a different domain. Please note the classic version of HttpClient is not affected by this vulnerability. Affected users are recommended to upgrade to at least version 5.6.4, which fixes the issue.","status":"published","published":"2026-08-11T21:17:00Z","modified":"2026-10-17T13:00:42.534729009Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T16:57:03.035847Z"},{"id":"CLSA-2026-1787027808","title":"TuxCare security update for org.apache.httpcomponents.client5:httpclient5 (1 CVE)","description":"TuxCare rebuilt org.apache.httpcomponents.client5:httpclient5 to address 1 CVE. Fixed in 5.5.2-tuxcare.2.","status":"published","published":"2026-08-18T04:36:48Z","modified":"2026-10-30T19:45:11.575479041Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1792745046","title":"TuxCare security update for org.apache.httpcomponents.client5:httpclient5 (2 CVEs)","description":"TuxCare rebuilt org.apache.httpcomponents.client5:httpclient5 to address 2 CVEs. Fixed in 5.4.4-tuxcare.1.","status":"published","published":"2026-10-23T08:44:06Z","modified":"2026-11-02T19:46:31.00692407Z","updated_at":"2026-11-02T20:28:59.01272Z"}]}}