org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks

A flaw was found in Apache HttpComponents Core. This vulnerability, located in the HTTP/2 HPACK decoder, allows a remote attacker to cause a denial of service. By sending oversized compressed header blocks, an attacker can exhaust memory resources before the system's configured header list size...

UBUNTU-CVE-2026-71290

Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicyBUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonat...

Denial-of-service (DoS)

Apache HttpComponents Core is vulnerable to a denial-of-service DoS vulnerability. The vulnerability is due to the decoder processing oversized compressed HTTP/2 header blocks without applying the configured header list size limit until the SETTINGS acknowledgement, which allows a remote attacker...

DEBIAN-CVE-2026-71290

Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicyBUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonat...

CVE-2026-71290

Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicyBUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonat...

CVE-2026-71290 Apache HttpComponents Client: TLS hostname verification silently disabled on the async transport (default config, MITM)

Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicyBUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonat...

CVE-2026-71290

CVE-2026-71290 affects Apache HttpComponents Client 5.4+ where TLS hostname verification is silently disabled for the async transport when using HostnameVerificationPolicy#BUILTIN. An attacker capable of intercepting/modifying traffic can impersonate the server by presenting a valid certificate f...

EUVD-2026-56973

Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicyBUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonat...

CVE-2026-71290 Apache HttpComponents Client: TLS hostname verification silently disabled on the async transport (default config, MITM)

Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicyBUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonat...

CVE-2026-71290

Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicyBUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonat...

CVE-2026-71290

Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicyBUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonat...

PT-2026-70917

Name of the Vulnerable Software and Affected Versions Apache HttpComponents Client versions 5.4 through 5.6.3 Description An issue exists where the HostnameVerificationPolicyBUILTIN setting is ignored when using the async version of HttpClient. This failure in TLS hostname verification allows an...

K000162851: Apache HttpComponents vulnerabilities CVE-2026-54399,CVE-2026-54428

Security Advisory Description CVE-2026-54399 Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core 5.4.2 and earlier, 5.5-beta1 and earlier allows an remote attacker to cause a denial of service through memory exhaustion by sending messages...

Security Bulletin: IBM Cloud Pak for Data System (CPDS 1x) is affected by HTTP message parser vulnerability due to Apache HttpComponents Core

Summary Apache HttpComponents Core is used by IBM Cloud Pak for Data System 1x to provide HTTP client and server functionality. CVE-2026-54399 affects Apache HttpComponents Core's HTTP/1.1 message parser when processing messages with excessive headers or header lengths, allowing remote attackers ...

Security Bulletin: IBM SPSS Modeler is affected by Uncontrolled Resource Consumption vulnerability in Apache HttpComponents Core

Summary Security Bulletin: IBM SPSS Modeler is affected by Uncontrolled Resource Consumption vulnerability in Apache HttpComponents Core. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-54399 DESCRIPTION: Uncontrolled Resource Consumption vulnerability in...

Linux Distros Unpatched Vulnerability : CVE-2026-64607

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or...

GHSA-HJCP-JMPX-G3QM Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS

HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. Please note this defect does not affect HttpClient based on the async i/o...

CVE-2026-64607

HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. Please note this defect does not affect HttpClient based on the async i/o...

CVE-2026-64607 Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS

HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. Please note this defect does not affect HttpClient based on the async i/o...

org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers

A flaw was found in Apache HttpComponents Core. This uncontrolled resource consumption vulnerability in the HTTP/1.1 message parser allows a remote attacker to cause a denial of service through memory exhaustion. This can be triggered by sending messages with an excessive number of headers or...