CVE-2026-71290: Apache HttpComponents Client: TLS hostname verification silently disabled on the async transport (default config, MITM)
Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicy#BUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonate the server by presenting a valid certificate for a different domain.
Please note the classic version of HttpClient is not affected by this vulnerability.
Affected users are recommended to upgrade to at least version 5.6.4, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache HttpComponents Clientto a version that resolves this vulnerability.Fixed in 5.6.4 - Compensating control
If you cannot upgrade immediately, avoid using the async transport where TLS hostname verification is silently disabled under the default configuration (MITM risk). Use the classic version of HttpClient, which is stated as not affected.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-71290?
The severity of CVE-2026-71290 is rated as 62.
How do I fix CVE-2026-71290?
To fix CVE-2026-71290, ensure that the hostname verification is correctly configured in the HttpComponents Client Async transport settings.
What systems are affected by CVE-2026-71290?
CVE-2026-71290 affects users of Apache HttpComponents Client version 5.4 or newer.
What type of vulnerability is CVE-2026-71290?
CVE-2026-71290 is classified as an improper TLS hostname verification vulnerability.
What can an attacker do with CVE-2026-71290?
An attacker can intercept and modify traffic between the client and the server, potentially impersonating the server.