https://seclists.org/oss-sec/2026/q3/481: CVE-2026-71290: Apache HttpComponents Client: TLS hostname verification silently disabled on the async transport (default config, MITM)

Q: What is the severity of CVE-2026-71290?

The severity of CVE-2026-71290 is classified as important.

Q: How do I fix CVE-2026-71290?

To fix CVE-2026-71290, update Apache HttpComponents Client to a version newer than 5.6.3.

Q: Which versions of Apache HttpComponents Client are affected by CVE-2026-71290?

CVE-2026-71290 affects Apache HttpComponents Client versions 5.4-alpha through 5.6.3.

Q: What is the main issue described in CVE-2026-71290?

CVE-2026-71290 describes an improper TLS hostname verification vulnerability that can lead to a Man-in-the-Middle (MITM) attack.

Q: What security risk does CVE-2026-71290 pose?

The security risk posed by CVE-2026-71290 is that it allows attackers to intercept and potentially manipulate data transmitted over HTTPS connections.

Published Aug 13, 2026

Updated

Affected Software

2 affected components

Apache HttpComponents Client>=5.4-alpha<=5.6.3

maven/org.apache.httpcomponents.client5/httpclient5>=5.4-alpha<=5.6.3

Frequently Asked Questions

What is the severity of CVE-2026-71290?

The severity of CVE-2026-71290 is classified as important.

How do I fix CVE-2026-71290?

To fix CVE-2026-71290, update Apache HttpComponents Client to a version newer than 5.6.3.

Which versions of Apache HttpComponents Client are affected by CVE-2026-71290?

CVE-2026-71290 affects Apache HttpComponents Client versions 5.4-alpha through 5.6.3.

What is the main issue described in CVE-2026-71290?

CVE-2026-71290 describes an improper TLS hostname verification vulnerability that can lead to a Man-in-the-Middle (MITM) attack.

What security risk does CVE-2026-71290 pose?

The security risk posed by CVE-2026-71290 is that it allows attackers to intercept and potentially manipulate data transmitted over HTTPS connections.

https://seclists.org/oss-sec/2026/q3/481: CVE-2026-71290: Apache HttpComponents Client: TLS hostname verification silently disabled on the async transport (default config, MITM)

Affected Software

Don't miss critical vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2026-71290?

How do I fix CVE-2026-71290?

Which versions of Apache HttpComponents Client are affected by CVE-2026-71290?

What is the main issue described in CVE-2026-71290?

What security risk does CVE-2026-71290 pose?

Company

Resources

Contact

Frequently Asked Questions

What is the severity of CVE-2026-71290?

How do I fix CVE-2026-71290?

Which versions of Apache HttpComponents Client are affected by CVE-2026-71290?

What is the main issue described in CVE-2026-71290?

What security risk does CVE-2026-71290 pose?