Vulnerability record · CVE-2026-71290 · published 11 August 2026

CVE-2026-71290: Apache httpclient improper certificate validation vulnerability

Apache · Httpclient

Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicy#BUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonate the server by presenting a valid certificate for a different domain. Please note the classic version of HttpClient is not affected by this vulnerability. Affected users are recommended to upgrade to at least version 5.6.4, which fixes the issue.

9.1 CVSS 3.1 Critical EPSS 0.33% · top 76.3% CWE-295 · Improper certificate validation

9.1CVSS 3.1 base score

0.33%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

2References

24 Sep 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Httpclient Apache

References

Link	Tags
https://lists.apache.org/thread/bhf7g2zwpom2ohvwjjjlonc93br2s8vq	Mailing ListRelease Notes
http://www.openwall.com/lists/oss-security/2026/08/13/6	Mailing ListThird Party Advisory

Track CVE-2026-71290 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2013-4366Apache httpclient improper input validation vulnerabilityhttp/impl/client/HttpClientBuilder.java in Apache HttpClient 4.3.x before 4.3.1 does not ensure that X509HostnameVerifier is not null, which allows a…EPSS 3.3%30 Oct 2017 7.5CVE-2025-27820Apache httpclient improper certificate validation vulnerabilityA bug in PSL validation logic in Apache HttpClient 5.4.x disables domain checks, affecting cookie management and host name verification. Discovered b…EPSS 0.95%24 Apr 2025 7.3CVE-2026-40542Apache httpclient vulnerabilityMissing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication withou…EPSS 0.70%22 Apr 2026 5.8CVE-2014-3577Apache httpclient vulnerabilityorg.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify …EPSS 9.1%21 Aug 2014 5.8CVE-2012-5783Apache httpclient improper certificate validation vulnerabilityApache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the serve…EPSS 9.3%4 Nov 2012 5.3CVE-2026-64607Apache httpclient vulnerabilityHttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an inv…EPSS 0.46%31 Jul 2026 5.3CVE-2020-13956Apache httpclient vulnerabilityApache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as …EPSS 9.0%2 Dec 2020 4.3CVE-2015-5262Canonical ubuntu linux vulnerabilityhttp/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the http.socket.timeout configuration setting …EPSS 19%27 Oct 2015

Source: NIST National Vulnerability Database (record CVE-2026-71290), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.