CVE-2026-71290

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-71290", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-08-05T12:30:56.682Z", "datePublished": "2026-08-11T20:33:56.947Z", "dateUpdated": "2026-09-24T03:55:24.916Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://repo.maven.apache.org/maven2/", "defaultStatus": "unaffected", "packageName": "org.apache.httpcomponents.client5:httpclient5", "product": "Apache HttpComponents Client", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "5.6.3", "status": "affected", "version": "5.4-alpha", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "n0mi1k"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer.&nbsp;HostnameVerificationPolicy#BUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonate the server by presenting a valid certificate for a different domain.&nbsp;<br></p><p>Please note the classic version of HttpClient is not affected by this vulnerability.&nbsp;</p><p>Affected users are recommended to upgrade to at least version 5.6.4, which fixes the issue.<br></p>"}], "value": "Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer.\u00a0HostnameVerificationPolicy#BUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonate the server by presenting a valid certificate for a different domain.\u00a0\n\n\nPlease note the classic version of HttpClient is not affected by this vulnerability.\u00a0\n\nAffected users are recommended to upgrade to at least version 5.6.4, which fixes the issue."}], "metrics": [{"other": {"content": {"text": "important"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-295", "description": "CWE-295 Improper Certificate Validation", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-08-13T09:30:14.754Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://lists.apache.org/thread/bhf7g2zwpom2ohvwjjjlonc93br2s8vq"}], "source": {"discovery": "UNKNOWN"}, "title": "Apache HttpComponents Client: TLS hostname verification silently disabled on the async transport (default config, MITM)", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-09-23T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-71290"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-24T03:55:24.916Z"}}, {"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/08/13/6"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-08-13T16:18:22.325Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/08/13/6"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-08-13T16:18:22.325Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-71290", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-12T19:19:57.559731Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-12T19:20:15.021Z"}}], "cna": {"title": "Apache HttpComponents Client: TLS hostname verification silently disabled on the async transport (default config, MITM)", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "n0mi1k"}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "important"}}}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache HttpComponents Client", "versions": [{"status": "affected", "version": "5.4-alpha", "versionType": "semver", "lessThanOrEqual": "5.6.3"}], "packageName": "org.apache.httpcomponents.client5:httpclient5", "collectionURL": "https://repo.maven.apache.org/maven2/", "defaultStatus": "unaffected"}], "references": [{"url": "https://lists.apache.org/thread/bhf7g2zwpom2ohvwjjjlonc93br2s8vq", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer.\u00a0HostnameVerificationPolicy#BUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonate the server by presenting a valid certificate for a different domain.\u00a0\n\n\nPlease note the classic version of HttpClient is not affected by this vulnerability.\u00a0\n\nAffected users are recommended to upgrade to at least version 5.6.4, which fixes the issue.", "supportingMedia": [{"type": "text/html", "value": "<p>Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer.&nbsp;HostnameVerificationPolicy#BUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonate the server by presenting a valid certificate for a different domain.&nbsp;<br></p><p>Please note the classic version of HttpClient is not affected by this vulnerability.&nbsp;</p><p>Affected users are recommended to upgrade to at least version 5.6.4, which fixes the issue.<br></p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-295", "description": "CWE-295 Improper Certificate Validation"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-08-13T09:30:14.754Z"}}}, "cveMetadata": {"cveId": "CVE-2026-71290", "state": "PUBLISHED", "dateUpdated": "2026-09-24T03:55:24.916Z", "dateReserved": "2026-08-05T12:30:56.682Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2026-08-11T20:33:56.947Z", "assignerShortName": "apache"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.maven.apache.org/maven2/", "defaultStatus": "unaffected", "packageName": "org.apache.httpcomponents.client5:httpclient5", "product": "Apache HttpComponents Client", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "5.6.3", "status": "affected", "version": "5.4-alpha", "versionType": "semver"}]}], "source": "security@apache.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:httpclient:*:*:*:*:*:*:*:*", "matchCriteriaId": "E0A77896-6021-44F0-9EA9-C79EECD7A7E8", "versionEndExcluding": "5.6.4", "versionStartIncluding": "5.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer.\u00a0HostnameVerificationPolicy#BUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonate the server by presenting a valid certificate for a different domain.\u00a0\n\n\nPlease note the classic version of HttpClient is not affected by this vulnerability.\u00a0\n\nAffected users are recommended to upgrade to at least version 5.6.4, which fixes the issue."}, {"lang": "es", "value": "Vulnerabilidad de verificaci\u00f3n de nombre de host TLS incorrecta en Apache HttpComponents Client 5.4 o posterior. La configuraci\u00f3n HostnameVerificationPolicy#BUILTIN no tiene efecto cuando se usa con la versi\u00f3n as\u00edncrona de HttpClient. Un atacante que puede interceptar y modificar el tr\u00e1fico entre el cliente y el servidor puede suplantar al servidor presentando un certificado v\u00e1lido para un dominio diferente.\n\nTenga en cuenta que la versi\u00f3n cl\u00e1sica de HttpClient no se ve afectada por esta vulnerabilidad.\n\nSe recomienda a los usuarios afectados actualizar a la versi\u00f3n 5.6.4 como m\u00ednimo, que corrige el problema."}], "id": "CVE-2026-71290", "lastModified": "2026-10-24T15:10:00.190", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-71290", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-09-23T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-08-11T21:17:51.157", "references": [{"source": "security@apache.org", "tags": ["Mailing List", "Release Notes"], "url": "https://lists.apache.org/thread/bhf7g2zwpom2ohvwjjjlonc93br2s8vq"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2026/08/13/6"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-295"}], "source": "security@apache.org", "type": "Secondary"}]}

{"bugzilla": {"description": "org.apache.httpcomponents/httpclient5: Apache HttpComponents Client: Server impersonation via improper TLS hostname verification", "id": "2514394", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514394"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.1", "cvss3_scoring_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "status": "draft"}, "cwe": "CWE-295", "details": ["A flaw was found in the asynchronous version of Apache HttpComponents Client. This improper Transport Layer Security (TLS) hostname verification vulnerability allows a remote attacker to intercept and modify network traffic. By presenting a valid certificate for a different domain, an attacker can impersonate the server, leading to a Man-in-the-Middle (MITM) attack and compromising communication."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-71290", "package_state": [{"cpe": "cpe:/a:redhat:ocp_tools", "fix_state": "Under investigation", "package_name": "jenkins-2-plugins", "product_name": "OpenShift Developer Tools and Services"}, {"cpe": "cpe:/a:redhat:ocp_tools", "fix_state": "Under investigation", "package_name": "ocp-tools-4/jenkins-rhel8", "product_name": "OpenShift Developer Tools and Services"}, {"cpe": "cpe:/a:redhat:ocp_tools", "fix_state": "Under investigation", "package_name": "ocp-tools-4/jenkins-rhel9", "product_name": "OpenShift Developer Tools and Services"}, {"cpe": "cpe:/a:redhat:serverless:1", "fix_state": "Under investigation", "package_name": "openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9", "product_name": "OpenShift Serverless"}, {"cpe": "cpe:/a:redhat:serverless:1", "fix_state": "Under investigation", "package_name": "openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9", "product_name": "OpenShift Serverless"}, {"cpe": "cpe:/a:redhat:serverless:1", "fix_state": "Under investigation", "package_name": "openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9", "product_name": "OpenShift Serverless"}, {"cpe": "cpe:/a:redhat:serverless:1", "fix_state": "Under investigation", "package_name": "openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9", "product_name": "OpenShift Serverless"}, {"cpe": "cpe:/a:redhat:serverless:1", "fix_state": "Under investigation", "package_name": "openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9", "product_name": "OpenShift Serverless"}, {"cpe": "cpe:/a:redhat:serverless:1", "fix_state": "Under investigation", "package_name": "openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel9", "product_name": "OpenShift Serverless"}, {"cpe": "cpe:/a:redhat:camel_quarkus:3", "fix_state": "Under investigation", "package_name": "camel-quarkus-support-httpclient5", "product_name": "Red Hat build of Apache Camel 4 for Quarkus 3"}, {"cpe": "cpe:/a:redhat:camel_quarkus:3", "fix_state": "Under investigation", "package_name": "camel-quarkus-support-httpclient5-deployment", "product_name": "Red Hat build of Apache Camel 4 for Quarkus 3"}, {"cpe": "cpe:/a:redhat:camel_quarkus:3", "fix_state": "Under investigation", "package_name": "httpclient5", "product_name": "Red Hat build of Apache Camel 4 for Quarkus 3"}, {"cpe": "cpe:/a:redhat:camel_quarkus:3", "fix_state": "Under investigation", "package_name": "httpclient5-cache", "product_name": "Red Hat build of Apache Camel 4 for Quarkus 3"}, {"cpe": "cpe:/a:redhat:camel_quarkus:3", "fix_state": "Under investigation", "package_name": "quarkus-apache-httpclient", "product_name": "Red Hat build of Apache Camel 4 for Quarkus 3"}, {"cpe": "cpe:/a:redhat:camel_spring_boot:4", "fix_state": "Under investigation", "package_name": "httpclient5", "product_name": "Red Hat build of Apache Camel for Spring Boot 4"}, {"cpe": "cpe:/a:redhat:camel_spring_boot:4", "fix_state": "Under investigation", "package_name": "httpclient5-cache", "product_name": "Red Hat build of Apache Camel for Spring Boot 4"}, {"cpe": "cpe:/a:redhat:camel_spring_boot:4", "fix_state": "Under investigation", "package_name": "httpclient5-parent", "product_name": "Red Hat build of Apache Camel for Spring Boot 4"}, {"cpe": "cpe:/a:redhat:apicurio_registry:3", "fix_state": "Under investigation", "package_name": "httpclient5", "product_name": "Red Hat build of Apicurio Registry 3"}, {"cpe": "cpe:/a:redhat:apicurio_registry:3", "fix_state": "Under investigation", "package_name": "quarkus-apache-httpclient", "product_name": "Red Hat build of Apicurio Registry 3"}, {"cpe": "cpe:/a:redhat:debezium:3", "fix_state": "Under investigation", "package_name": "httpclient5", "product_name": "Red Hat build of Debezium 3"}, {"cpe": "cpe:/a:redhat:quarkus:3", "fix_state": "Under investigation", "package_name": "quarkus-apache-httpclient", "product_name": "Red Hat build of Quarkus"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Under investigation", "package_name": "jmc", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Under investigation", "package_name": "rhoai/odh-modelmesh-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Under investigation", "package_name": "devspaces/jetbrains-ide-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Under investigation", "package_name": "devspaces/openvsx-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Under investigation", "package_name": "devspaces/pluginregistry-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}], "public_date": "2026-08-11T20:33:56Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-71290\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-71290\nhttps://lists.apache.org/thread/bhf7g2zwpom2ohvwjjjlonc93br2s8vq"], "statement": "This vulnerability is rated as Important as it allows for server impersonation in Red Hat products utilizing the asynchronous Apache HttpComponents Client. An attacker positioned to intercept and alter network traffic can present a fraudulent server certificate, bypassing TLS hostname verification and potentially leading to man-in-the-middle attacks. This flaw does not affect the classic version of HttpClient.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[5.4-alpha,5.6.3]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Apache HttpComponents Client", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "httpcomponents_client", "vendor": "apache"}], "created": "2026-08-12T14:30:03.148410+00:00", "updated": "2026-08-13T10:45:03.999014+00:00", "vendors": ["apache", "apache$PRODUCT$httpcomponents_client"]}