Bug 2514394 (CVE-2026-71290) - CVE-2026-71290 org.apache.httpcomponents/httpclient5: Apache HttpComponents Client: Server impersonation via improper TLS hostname verification
Summary: CVE-2026-71290 org.apache.httpcomponents/httpclient5: Apache HttpComponents C...
Keywords:
Status: NEW
Alias: CVE-2026-71290
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-08-11 20:51 UTC by OSIDB Bzimport
Modified: 2026-08-17 19:09 UTC (History)
48 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-08-11 20:51:23 UTC 
Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicy#BUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and
 the server can impersonate the server by presenting a valid certificate
 for a different domain. 


Please note the classic version of HttpClient is not affected by this vulnerability. 

Affected users are recommended to upgrade to at least version 5.6.4, which fixes the issue.
Note You need to log in before you can comment on or make changes to this bug.