Read the docs
TI-2026-49957 Aliases CVE-2026-71290GHSA-72q8-9rgw-5g6j

Apache HttpComponents Client: TLS hostname verification silently disabled on the async transport (default config, MITM)

Priority MEDIUM 47CWE-295Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Spoofing
Confidentiality · integrity · availability
High · High · None
Fix status
Partial Red Hat: 4 fixed, 4 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-295.

Summary

Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicy#BUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonate the server by presenting a valid certificate for a different domain.  Please note the classic version of HttpClient is not affected by this vulnerability.  Affected users are recommended to upgrade to at least version 5.6.4, which fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00331 26th percentileScored 2026-11-07
Fix Partial Red Hat: 4 advisoriesRed Hat: 4 fixed, 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache HttpComponents Client5.4-alpha – 5.6.3—No fix listedCNA
  • Apache HttpComponents Client VendorApache Affected 5.4-alpha – 5.6.3 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:httpclient:*:*:*:*:*:*:*:*5.4 to before 5.6.4VulnerableApache
  • cpe:2.3:a:apache:httpclient:*:*:*:*:*:*:*:* Versions 5.4 to before 5.6.4 Vulnerable ·Apache

Remediation

Red Hat 4 advisories

  • RHSA-2026:90321 Released 2026-10-26 · Red Hat rating Critical
    Red Hat OpenShift Dev Spaces 3.31.0 Release.
    • Red Hat OpenShift Dev Spaces 3.31 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/jetbrains-ide-rhel9 +8
  • RHSA-2026:83612 Released 2026-10-15 · Red Hat rating Important
    Red Hat build of Debezium 3.6.3 release
    • Red Hat Build of Debezium 3.6
  • RHSA-2026:63302 Released 2026-09-03 · Red Hat rating Important
    Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.3.SP1)
    • Red Hat Build of Apache Camel 3.33.3.SP1 io.netty.netty-codec-http-4.1.137.Final-redhat-00001.jar, io.netty.netty-handler-4.1.137.Final-redhat-00001.jar, io.quarkus.quarkus-qute-3.33.3.redhat-00005.jar +5
Show 1 more Red Hat advisories
  • RHSA-2026:62515 Released 2026-09-03 · Red Hat rating Important
    Red Hat build of Quarkus 3.27.5.SP1 release and security update
    • Red Hat build of Quarkus 3.27.5.SP1 io.netty.netty-codec-http-4.1.137.Final-redhat-00001.jar, io.netty.netty-handler-4.1.137.Final-redhat-00001.jar, io.quarkus.quarkus-apache-httpclient-3.27.5.redhat-00004.jar +7

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 9Affected—
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat build of Apache Camel 4 for Quarkus 3AffectedNo fix yet
Red Hat build of Apicurio Registry 3AffectedNo fix yet
Red Hat Build of Apache Camel 3.33.3.SP1Fixed RHSA-2026:63302
Red Hat Build of Debezium 3.6Fixed RHSA-2026:83612
Red Hat OpenShift Dev Spaces 3.31Fixed RHSA-2026:90321
Red Hat build of Quarkus 3.27.5.SP1Fixed RHSA-2026:62515
Not affected: 7 products
  • OpenShift Developer Tools and Services
  • OpenShift Serverless
  • Red Hat Build of Apache Camel 3.33.3.SP1
  • Red Hat OpenShift Dev Spaces 3.31
  • Red Hat build of Apache Camel 4 for Quarkus 3
  • Red Hat build of Apache Camel for Spring Boot 4
  • Red Hat build of Quarkus 3.27.5.SP1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-71290
  2. 2026-10-03 Alias added: GHSA-72q8-9rgw-5g6j
  3. 2026-10-09 Fix available: RHSA-2026:63302 · Red Hat
  4. 2026-10-09 Fix available: RHSA-2026:62515 · Red Hat
  5. 2026-10-09 Fix available: Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP1, Red Hat build of Quarkus 3.27.5.SP1 · Red Hat
  6. 2026-10-12 Fix available: Red Hat Build of Apache Camel 3.33.3.SP1 · Red Hat
  7. 2026-10-16 Fix available: RHSA-2026:83612 · Red Hat
  8. 2026-10-16 Fix available: Red Hat Build of Debezium 3.6 · Red Hat
  9. 2026-10-20 Affected versions changed · Red Hat
  10. 2026-10-29 Fix available: Red Hat OpenShift Dev Spaces 3.31 · Red Hat
  11. 2026-10-30 Fix available: RHSA-2026:90321 · Red Hat

References

Advisory 2

  • TI-2013-03825 http/impl/client/HttpClientBuilder.java in Apache HttpClient 4.3.x before 4.3.1 does not… CVSS 3.1CRITICAL 9.8
  • TI-2020-10932 Improper input validation in Apache HttpClient CVSS 3.1MEDIUM 5.3
  • TI-2025-20592 Apache HttpComponents: PSL (Public Suffix List) validation bypass CVSS 3.1HIGH 7.5
  • TI-2026-29288 Apache HttpClient: SCRAM-SHA-256 mutual authentication bypass may cause the client to… CVSS 3.1HIGH 7.3
  • TI-2015-04421 http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before… CVSS 2.0MEDIUM 4.3
  • TI-2014-02901 org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before… CVSS 2.0MEDIUM 5.8
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences