CVE-2026-71290

Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicy#BUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonate the server by presenting a valid certificate for a different domain. Please note the classic version of HttpClient is not affected by this vulnerability. Affected users are recommended to upgrade to at least version 5.6.4, which fixes the issue.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread/bhf7g2zwpom2ohvwjjjlonc93br2s8vq	Mailing List Release Notes
http://www.openwall.com/lists/oss-security/2026/08/13/6	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:httpclient:*:*:*:*:*:*:*:*

History

23 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Vulnerabilidad de verificación de nombre de host TLS incorrecta en Apache HttpComponents Client 5.4 o posterior. La configuración HostnameVerificationPolicy#BUILTIN no tiene efecto cuando se usa con la versión asíncrona de HttpClient. Un atacante que puede interceptar y modificar el tráfico entre el cliente y el servidor puede suplantar al servidor presentando un certificado válido para un dominio diferente. Tenga en cuenta que la versión clásica de HttpClient no se ve afectada por esta vulnerabilidad. Se recomienda a los usuarios afectados actualizar a la versión 5.6.4 como mínimo, que corrige el problema.

Information

Published : 2026-08-11 21:17

Updated : 2026-10-24 15:10

NVD link : CVE-2026-71290

Mitre link : CVE-2026-71290

CVE.ORG link : CVE-2026-71290

JSON object : View

Products Affected

apache

httpclient

CWE

CWE-295

Improper Certificate Validation

{"id": "CVE-2026-71290", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-71290", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-09-23T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache HttpComponents Client", "versions": [{"status": "affected", "version": "5.4-alpha", "versionType": "semver", "lessThanOrEqual": "5.6.3"}], "packageName": "org.apache.httpcomponents.client5:httpclient5", "collectionURL": "https://repo.maven.apache.org/maven2/", "defaultStatus": "unaffected"}]}], "published": "2026-08-11T21:17:51.157", "references": [{"url": "https://lists.apache.org/thread/bhf7g2zwpom2ohvwjjjlonc93br2s8vq", "tags": ["Mailing List", "Release Notes"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/08/13/6", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-295"}]}], "descriptions": [{"lang": "en", "value": "Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer.\u00a0HostnameVerificationPolicy#BUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonate the server by presenting a valid certificate for a different domain.\u00a0\n\n\nPlease note the classic version of HttpClient is not affected by this vulnerability.\u00a0\n\nAffected users are recommended to upgrade to at least version 5.6.4, which fixes the issue."}, {"lang": "es", "value": "Vulnerabilidad de verificaci\u00f3n de nombre de host TLS incorrecta en Apache HttpComponents Client 5.4 o posterior. La configuraci\u00f3n HostnameVerificationPolicy#BUILTIN no tiene efecto cuando se usa con la versi\u00f3n as\u00edncrona de HttpClient. Un atacante que puede interceptar y modificar el tr\u00e1fico entre el cliente y el servidor puede suplantar al servidor presentando un certificado v\u00e1lido para un dominio diferente.\n\nTenga en cuenta que la versi\u00f3n cl\u00e1sica de HttpClient no se ve afectada por esta vulnerabilidad.\n\nSe recomienda a los usuarios afectados actualizar a la versi\u00f3n 5.6.4 como m\u00ednimo, que corrige el problema."}], "lastModified": "2026-10-24T15:10:00.190", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:httpclient:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E0A77896-6021-44F0-9EA9-C79EECD7A7E8", "versionEndExcluding": "5.6.4", "versionStartIncluding": "5.4"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}