CVE-2026-71290

The issue is an improper TLS hostname verification in Apache HttpComponents Client 5.4+ (async transport). The HostnameVerificationPolicy#BUILTIN setting has no effect on the async HttpClient, enabling a MITM attacker to impersonate a server by presenting a valid certificate for another domain. T...