CVE-2026-71290: Apache HttpComponents Client: TLS hostname verification silently disabled on the async transport (default config, MITM)
Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicy#BUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonate the server by presenting a valid certificate for a different domain.
Please note the classic version of HttpClient is not affected by this vulnerability.
Affected users are recommended to upgrade to at least version 5.6.4, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.6.4 - Configuration
Do not rely on HostnameVerificationPolicy#BUILTIN with the async transport; upgrade to at least 5.6.4 where the issue is fixed.
Apache HttpComponents Client (async transport) HostnameVerificationPolicy#BUILTIN = No effect (hostname verification silently disabled on async transport default config)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-71290?
The severity of CVE-2026-71290 is rated as 62.
How do I fix CVE-2026-71290?
To fix CVE-2026-71290, ensure that the hostname verification is correctly configured in the HttpComponents Client Async transport settings.
What systems are affected by CVE-2026-71290?
CVE-2026-71290 affects users of Apache HttpComponents Client version 5.4 or newer.
What type of vulnerability is CVE-2026-71290?
CVE-2026-71290 is classified as an improper TLS hostname verification vulnerability.
What can an attacker do with CVE-2026-71290?
An attacker can intercept and modify traffic between the client and the server, potentially impersonating the server.