Apache HttpComponents: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen

Summary

Product

Vulnerabilities 1

• Critical 9.1
  CVE-2026-71290

  Apache HttpComponents Client: TLS hostname verification silently disabled on the async transport (default config, MITM)

  Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicy#BUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between t…

  Apache Software Foundation Apache HttpComponents Client httpcomponents-core5 httpcomponents-core5 Debian Ubuntu
  Aug 11, 2026

Revision history

1. 2026-10-15 #4

   Neue Updates von Red Hat aufgenommen

2. 2026-09-06 #3

   Neue Updates von IBM und IBM-APAR aufgenommen

3. 2026-09-03 #2

   Neue Updates von Red Hat aufgenommen

4. 2026-08-11 #1

   Initiale Fassung

References

• Apache Mailing List vom 2026-08-11
  https://lists.apache.org/thread/bhf7g2zwpom2ohvwjjjlonc93br2s8vq
• EU Vulnerability Database vom 2026-08-11
  https://euvd.enisa.europa.eu/enisa/EUVD-2026-56973
• GitHub Advisory Database vom 2026-08-11
  https://github.com/advisories/GHSA-72Q8-9RGW-5G6J
• Red Hat Security Advisory RHSA-2026:62515 vom 2026-09-03
  https://access.redhat.com/errata/RHSA-2026:62515
• Red Hat Security Advisory RHSA-2026:62555 vom 2026-09-03
  https://access.redhat.com/errata/RHSA-2026:62555
• Red Hat Security Advisory RHSA-2026:63302 vom 2026-09-03
  https://access.redhat.com/errata/RHSA-2026:63302
• IBM Security Bulletin 7286368 vom 2026-09-04
  https://www.ibm.com/support/pages/node/7286368
• Red Hat Security Advisory RHSA-2026:83612 vom 2026-10-15
  https://access.redhat.com/errata/RHSA-2026:83612