CVE-2026-71290criticalCWE-295

CVE-2026-71290: fallo crítico en Apache HttpComponents Client

Apache HttpComponents Client: TLS hostname verification silently disabled on the async transport (default config, MITM)

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Apache HttpComponents Client+ Monitorear httpcomponents-core5

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

28Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 9.1epss 0.3%
Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicy#BUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonate the server by presenting a valid certificate for a different domain.  Please note the classic version of HttpClient is not affected by this vulnerability.  Affected users are recommended to upgrade to at least version 5.6.4, which fixes the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Productos afectados
Apache Software Foundation · Apache HttpComponents Client
CVEs relacionadas — Apache HttpComponents Client

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-64607MEDIUMApache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoSEPSS 0.5%