CVE-2026-71290

CriticalCVSS 9.1/10Last modified Oct 24, 2026

Description

Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicy#BUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonate the server by presenting a valid certificate for a different domain.

Please note the classic version of HttpClient is not affected by this vulnerability.

Affected users are recommended to upgrade to at least version 5.6.4, which fixes the issue.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-295

Affected software

No affected versions have been published.

Timeline

Published: Aug 11, 2026
Last modified: Oct 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-712918.8Bolt CMS renders content field values through Twig's full application-level Environment with no SandboxExtension registered anywhere in the CVE-2026-712927.2Subrion CMS's admin grid sorting helper, _gridGetSorting in includes/classes/ia.base.controller.admin.php, whitelists the (ASC/DESC) request CVE-2026-712936.2Statamic CMS's user-augmentation resolver, AugmentedUser::get in src/Auth/AugmentedUser.php, contains an explicit case for the handle that r CVE-2026-712947.6Cotonti CMS's Comments plugin deserializes user-supplied data without restricting the classes that may be instantiated. In plugins/comments/CVE-2026-712975.4A flaw was found in the maestro gRPC broker. This vulnerability allows a remote attacker, with a valid client certificate, to bypass authent CVE-2026-712986.4A flaw was found in maestro. A remote attacker could exploit a SQL injection vulnerability in the `orderBy` query parameter of its REST API CVE-2026-712996.5A flaw was found in Maestro. Its REST API write endpoints were registered without proper authentication middleware. This allows a remote att CVE-2026-71307.3A flaw has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. The affected element is an unknown function of the file /aj CVE-2026-713009.8Improper input validation vulnerability in Apache Camel Atmosphere Websocket component. This issue affects Apache Camel: from 4.0.0 befor CVE-2026-713014.3Gitea's repository markup endpoint resolves same-repository pull request references without enforcing the viewer's Pull Requests permission.CVE-2026-713027.1The application accepts user-supplied session identifiers and does not regenerate the session ID after authentication. This allows an attack CVE-2026-713037.7Lemur manages TLS certificate creation. Prior to 1.9.3, _validate_acme_url enforced ACME_DIRECTORY_HOST_ALLOWLIST when an authority was crea