DEBIAN-CVE-2026-71290

Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicyBUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonat...

CVE-2026-71290 Apache HttpComponents Client: TLS hostname verification silently disabled on the async transport (default config, MITM)

Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicyBUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonat...

CVE-2026-71290

CVE-2026-71290 affects Apache HttpComponents Client 5.4+ where TLS hostname verification is silently disabled for the async transport when using HostnameVerificationPolicy#BUILTIN. An attacker capable of intercepting/modifying traffic can impersonate the server by presenting a valid certificate f...

CVE-2026-71290

Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicyBUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonat...

PT-2026-70917

Name of the Vulnerable Software and Affected Versions Apache HttpComponents Client versions 5.4 through 5.6.3 Description An issue exists where the HostnameVerificationPolicyBUILTIN setting is ignored when using the async version of HttpClient. This failure in TLS hostname verification allows an...

SUSE CVE-2026-64607

HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. Please note this defect does not affect HttpClient based on the async i/o...

Linux Distros Unpatched Vulnerability : CVE-2026-64607

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or...

CVE-2026-64607

HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. Please note this defect does not affect HttpClient based on the async i/o...

CVE-2026-64607 Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS

HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. Please note this defect does not affect HttpClient based on the async i/o...

CVE-2026-64607 Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS

HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. Please note this defect does not affect HttpClient based on the async i/o...

PT-2026-66745

HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. Please note this defect does not affect HttpClient based on the async i/o...

SUSE SLED15: httpcomponents-client / httpcomponents-client-cache / etc (SUSE-SU-2024:4036-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:4036-1 advisory. httpcomponents-client: - Update to version 4.5.14 HTTPCLIENT-2206: Corrected resource de-allocation by...

Security update for httpcomponents-client, httpcomponents-core

This update for httpcomponents-client, httpcomponents-core fixes the following issues: httpcomponents-client: - Update to version 4.5.14 HTTPCLIENT-2206: Corrected resource de-allocation by fluent response objects. HTTPCLIENT-2174: URIBuilder to return a new empty list instead of unmodifiable...

httpcomponents-client-4.5.14-1.1 on GA media (moderate)

httpcomponents-client-4.5.14-1.1 on GA media Announcement ID: openSUSE-SU-2024:14478-1 Rating: moderate Cross-References: CVE-2020-13956 CVSS scores: CVE-2020-13956 SUSE : 5.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N Affected Products: openSUSE Tumbleweed An update that solves one vulnerabili...

OPENSUSE-SU-2024:14478-1 httpcomponents-client-4.5.14-1.1 on GA media

These are all security issues fixed in the httpcomponents-client-4.5.14-1.1 package on the GA media of openSUSE Tumbleweed...

RHSA-2022:0722 Red Hat Security Advisory: rh-maven36-httpcomponents-client security update

Bulletin has no description...

RHSA-2014:1146 Red Hat Security Advisory: httpcomponents-client security update

Bulletin has no description...

RHSA-2014:1098 Red Hat Security Advisory: devtoolset-2-httpcomponents-client security update

Bulletin has no description...

Fedora: Security Advisory for httpcomponents-client (FEDORA-2024-129d8ca6fc)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 40 Update: httpcomponents-client-4.5.14-8.fc40

HttpClient is a HTTP/1.1 compliant HTTP agent implementation based on httpcomponents HttpCore. It also provides reusable components for client-side authentication, HTTP state management, and HTTP connection management. HttpComponents Client is a successor of and replacement for Commons HttpClient...