> CVE-2026-71290

« BACK_TO_HOME
PUBLISHED
2026-08-11 21:17
MODIFIED
2026-08-11 21:17
EPSS (Prob. Exploit)
0.33%
Top 74.9%
DATA SOURCES:
NVD 🔗 2026-08-11 CWE MITRE 🔗 2026-11-01 FIRST EPSS 🔗 2026-10-25 OSV 🔗 2026-09-21

> DESCRIPTION

Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicy#BUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonate the server by presenting a valid certificate for a different domain.  Please note the classic version of HttpClient is not affected by this vulnerability.  Affected users are recommended to upgrade to at least version 5.6.4, which fixes the issue.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> WEAKNESSES

CWE-295

> CWE DETAILED DESCRIPTIONS

CWE-295: Improper Certificate Validation - The product does not validate, or incorrectly validates, a certificate.

> RED HAT SECURITY ADVISORIES

Red Hat Security Advisory: Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.3.SP1)
An update for Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.3.SP1).The purpose of this text-only errata is to inform you about the enhancements that improve yo...
Red Hat Security Advisory: Red Hat build of Debezium 3.6.3 release
Red Hat build of Debezium connectors in version 3.6.3 are now available for Red Hat Application Foundations.
Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.31.0 Release.
Red Hat OpenShift Dev Spaces 3.31.0 has been released.

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

Apache HttpComponents Client: TLS hostname verification silently disabled on the async transport (default config, MITM)

AFFECTED PACKAGES:
Unknown / Unknown

> HISTORIQUE DES MODIFICATIONS

Première apparition
11/08/2026 21:17
Source: NVD
📊 ENRICHISSEMENT 01/09/2026 06:02
CWE
Champ modifié: Description CWE
Ancienne valeur:
N/A
Nouvelle valeur:
CWE-295: Improper Certificate Validation - The product does not validate, or incorrectly validates, a certificate.
Total des modifications: 1 Dernière mise à jour: 2 months ago

> REFERENCES

https://lists.apache.org/thread/bhf7g2zwpom2ohvwjjjlonc93br2s8vq
« BACK_TO_HOME