Vulnerability in Apache Software Foundation Httpcomponents Client
CVE-2026-71290
Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicy#BUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modi…
Vulnerability class: Improper Certificate Validation
Affected products
- Apache Software Foundation Httpcomponents Client — versions 5.4-alpha
Weakness classification (CWE)
References
- security@apache.org (vendor-advisory)