CVE-2026-71290

Analyzed Analyzed - Analysis Complete

Improper TLS Hostname Verification in Apache HttpComponents Client

Publication date: 2026-08-11

Last updated on: 2026-08-17

Assigner: Apache Software Foundation

Description

Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicy#BUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonate the server by presenting a valid certificate for a different domain. Please note the classic version of HttpClient is not affected by this vulnerability. Affected users are recommended to upgrade to at least version 5.6.4, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-17

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-30

NVD

CVE-2026-71290

Affected Vendors & Products

Vendor	Product	Version / Range
apache	httpclient	From 5.4 (inc) to 5.6.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-295	The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

Executive Summary

This vulnerability involves improper TLS hostname verification in Apache HttpComponents Client 5.4 or newer. When using the async version of HttpClient with the HostnameVerificationPolicy#BUILTIN setting, the hostname verification does not work correctly. An attacker could intercept and modify traffic between the client and server, impersonating the server by presenting a valid certificate for a different domain.

Detection Guidance

Detection involves checking the version of Apache HttpComponents Client in use. Commands like 'mvn dependency:tree' for Maven projects or inspecting dependency files can reveal if an affected version (5.4 or newer) is present. Ensure the async version of HttpClient is not being used with HostnameVerificationPolicy#BUILTIN.

Impact Analysis

If you use the affected versions of Apache HttpComponents Client with the async HttpClient and the BUILTIN hostname verification setting, an attacker could intercept your communications and impersonate a trusted server. This could lead to data breaches, unauthorized access, or man-in-the-middle attacks.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Organizations using the affected software may face legal and financial penalties for failing to protect sensitive data.

Mitigation Strategies

Upgrade to Apache HttpComponents Client version 5.6.4 or later. If using the async version of HttpClient, verify that HostnameVerificationPolicy#BUILTIN is not configured, as it has no effect. Replace with manual hostname verification if necessary.

Hi! I’m here to help you understand CVE-2026-71290. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70