CVE-2026-71290

The issue is an improper TLS hostname verification in Apache HttpComponents Client 5.4+ (async transport). The HostnameVerificationPolicy#BUILTIN setting has no effect on the async HttpClient, enabling a MITM attacker to impersonate a server by presenting a valid certificate for another domain. T...

CVE-2026-71290

Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicyBUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonat...