Apache Httpclient vulnerabilities

• apache httpclient, apache software foundation httpcomponents client +1 more Apache HttpComponents Client: TLS hostname verification silently disabled on the async transport (default config, MITM) CVE-2026-71290 Fix available 9.1 CriticalAugust 11, 2026
• apache httpclient, apache software foundation httpcomponents client +1 more Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS CVE-2026-64607 Fix available 5.3 MediumJuly 31, 2026
• apache httpclient, red hat cryostat 4, migration toolkit for applications 8 +45 more +47 more Apache HttpClient: SCRAM-SHA-256 mutual authentication bypass may cause the client to accept authentication without proper mutual authentication verification CVE-2026-40542 Fix available 7.3 HighApril 22, 2026
• apache httpclient, apache software foundation httpcomponents, netapp ontap tools +2 more Apache HttpComponents: PSL (Public Suffix List) validation bypass CVE-2025-27820 Fix available 7.5 HighApril 24, 2025
• apache httpclient, netapp active iq unified manager, snapcenter +14 more +16 more Cross-site scripting in Apache HttpClient CVE-2020-13956 Fix available 5.3 MediumOctober 10, 2020
• apache httpclient Hostname verification in Apache HttpClient 4.3 was disabled by default CVE-2013-4366 Fix available 9.8 CriticalOctober 30, 2017
• apache httpclient, canonical ubuntu linux, fedoraproject fedora +2 more Denial of service vulnerability in org.apache.httpcomponents:httpclient CVE-2015-5262 Fix available EPSS 18.8% 4.3 MediumSeptember 30, 2015
• apache commons-httpclient Improper certificate validation in org.apache.httpcomponents:httpclient CVE-2012-6153 Fix available 4.3 MediumAugust 25, 2014
• apache httpasyncclient, httpclient +1 more Improper Verification of Cryptographic Signature in org.apache.httpcomponents:httpclient CVE-2014-3577 Fix available 5.8 MediumAugust 21, 2014
• apache httpclient, canonical ubuntu linux +1 more Improper Certificate Validation in Apache Commons HttpClient CVE-2012-5783 Fix available 5.8 MediumNovember 4, 2012
• apache httpclient Exposure of Sensitive Information to an Unauthorized Actor in Apache HttpClient CVE-2011-1498 Fix available 4.3 MediumJuly 7, 2011