Product · Apache Software Foundation

Apache HttpComponents Client

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

Critical 9.1

CVE-2026-71290

Apache HttpComponents Client: TLS hostname verification silently disabled on the async transport (default config, MITM)

Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicy#BUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between t…

Apache Software Foundation Apache HttpComponents Client httpcomponents-core5 httpcomponents-core5 Debian Ubuntu

Aug 11, 2026