24 matches found
Security Bulletin: Multiple Security Vulnerabilities in Apache HttpComponents Client affect IBM Content Navigator
Summary Apache HttpComponents Client is affected by two vulnerabilities CVSS up to 9.1, Critical. CVE-2026-71290 CVSS 9.1 is an improper TLS hostname verification flaw in the async HttpClient versions 5.4 and later where HostnameVerificationPolicyBUILTIN has no effect, allowing a network attacker...
Security Bulletin: IBM Quantum Safe Explorer is affected by multiple vulnerabilities
Summary Multiple vulnerabilities are found in dependent open source libraries used in IBM Quantum Safe Explorer code base. IBM Quantum Safe Explorer has addressed these vulnerabilities by updating the versions of the affected libraries. Vulnerability Details CVEID:CVE-2026-64607 DESCRIPTION:...
Security Bulletin: HttpClient based on the classic i/o model fails to correctly release the underlying connection
Summary HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. Please note this defect does not affect HttpClient based on the...
org.apache.httpcomponents.client5/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak
A flaw was found in Apache HttpComponents Client, specifically in its classic input/output I/O model. When processing a response message with an invalid or unsupported Content-Encoding header, the client fails to properly release the underlying network connection. This connection leak can lead to...
Security Bulletin: Due to the use of Apache HttpComponents Client 5.4, IBM Sterling Control Center is vulnerable to Improper Certificate Validation (CVE-2026-71290)
Summary Apache HttpComponents Client 5.4 is used by IBM Sterling Control Center as part of dependency in httpclient5-5.4.3.jar. Vulnerability Details CVEID:CVE-2026-71290 DESCRIPTION: Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer...
Improper Certificate Validation
Apache HttpComponents Client is vulnerable to Improper Certificate Validation. The vulnerability is due to the HostnameVerificationPolicyBUILTIN setting being ineffective in the asynchronous HttpClient, which allows an attacker capable of intercepting and modifying traffic to impersonate the...
CLEANSTART-2026-OB74177 Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5
Multiple security vulnerabilities affect the spring-boot package. Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5. See references for individual vulnerability details...
CLEANSTART-2026-EC45528 Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5
Multiple security vulnerabilities affect the apache-nifi package. Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5. See references for individual vulnerability details...
org.apache.httpcomponents.client5/httpclient5: Apache HttpComponents Client: Server impersonation via improper TLS hostname verification
A flaw was found in the asynchronous version of Apache HttpComponents Client. This improper Transport Layer Security TLS hostname verification vulnerability allows a remote attacker to intercept and modify network traffic. By presenting a valid certificate for a different domain, an attacker can...
org.apache.httpcomponents.client5/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak
A flaw was found in Apache HttpComponents Client, specifically in its classic input/output I/O model. When processing a response message with an invalid or unsupported Content-Encoding header, the client fails to properly release the underlying network connection. This connection leak can lead to...
CVE-2026-64607
A flaw was found in Apache HttpComponents Client, specifically in its classic input/output I/O model. When processing a response message with an invalid or unsupported Content-Encoding header, the client fails to properly release the underlying network connection. This connection leak can lead to...
Improper Resource Shutdown
Apache HttpComponents Client is vulnerable to Improper Resource Shutdown. The vulnerability is due to the classic I/O model failing to release connections back to the connection manager when processing an invalid or unsupported Content-Encoding header value, potentially exhausting available...
DEBIAN-CVE-2026-71290
Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicyBUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonat...
CVE-2026-71290 Apache HttpComponents Client: TLS hostname verification silently disabled on the async transport (default config, MITM)
Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicyBUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonat...
CVE-2026-71290
Apache HttpComponents Client 5.4 and newer contains an improper TLS hostname verification vulnerability (CWE-295) in the async version of HttpClient. The root cause is that the HostnameVerificationPolicy#BUILTIN setting has no effect, allowing a network attacker to intercept traffic and impersona...
CVE-2026-71290
Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicyBUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonat...
CVE-2026-71290: Improper Certificate Validation
Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicyBUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonat...
PT-2026-70917
Name of the Vulnerable Software and Affected Versions Apache HttpComponents Client versions 5.4 through 5.6.3 Description An issue exists where the HostnameVerificationPolicyBUILTIN setting is ignored when using the async version of HttpClient. This failure in TLS hostname verification allows an...
Linux Distros Unpatched Vulnerability : CVE-2026-64607
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or...
CVE-2026-64607
HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. Please note this defect does not affect HttpClient based on the async i/o...