CVE-2026-63336 RabbitMQ Java client: TrustEverythingTrustManager used by default in useSslProtocol() enables MITM

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, com.rabbitmq.client.ConnectionFactory.useSslProtocol and ConnectionFactory.useSslProtocolString configure com.rabbitmq.client.TrustEverythingTrustManager and...

CVE-2026-63336

Prior to 5.33.0, the RabbitMQ Java client's useSslProtocol() methods installed a TrustEverythingTrustManager and disabled hostname verification, accepting any certificate. A network attacker could impersonate the broker, read protected AMQP traffic, and modify it. Fixed in 5.33.0, which uses the ...

CVE-2026-63336 RabbitMQ Java client: TrustEverythingTrustManager used by default in useSslProtocol() enables MITM

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, com.rabbitmq.client.ConnectionFactory.useSslProtocol and ConnectionFactory.useSslProtocolString configure com.rabbitmq.client.TrustEverythingTrustManager and...

CVE-2026-63336

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, com.rabbitmq.client.ConnectionFactory.useSslProtocol and ConnectionFactory.useSslProtocolString configure com.rabbitmq.client.TrustEverythingTrustManager and...

PT-2026-77210

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, com.rabbitmq.client.ConnectionFactory.useSslProtocol and ConnectionFactory.useSslProtocolString configure com.rabbitmq.client.TrustEverythingTrustManager and...

CVE-2026-71290

A flaw was found in the asynchronous version of Apache HttpComponents Client. This improper Transport Layer Security TLS hostname verification vulnerability allows a remote attacker to intercept and modify network traffic. By presenting a valid certificate for a different domain, an attacker can...

BIT-NODE-MIN-2026-58040

An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies incomplete fix of CVE-2026-48934. This vulnerability affects Node.js 22.x, 24.x, and 26.x...

BIT-NODE-2026-58040

An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies incomplete fix of CVE-2026-48934. This vulnerability affects Node.js 22.x, 24.x, and 26.x...

K000162943: Spring boot vulnerability CVE-2026-40992

Security Advisory Description Spring Boot's Mail auto-configuration does not enable hostname verification. Applications that set the relevant JavaMail property, such as spring.mail.properties.mail.smtp.ssl.checkserveridentity=true, are not affected. Affected versions: Spring Boot 4.0.0 through...

Improper Certificate Validation

Spring Boot is vulnerable to Improper Certificate Validation. The vulnerability is due to hostname verification being disabled in Mail auto-configuration, which allows an attacker capable of intercepting the SMTP connection to impersonate the intended mail server and potentially access or...

Security Bulletin:Vulnerability in crypto affects IBM Netezza Appliance

Summary The crypto package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVECVE-2026-27145 Vulnerability Details CVEID:CVE-2026-27145 DESCRIPTION:x509.Certificate.VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name...

DEBIAN-CVE-2026-71290

Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicyBUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonat...

CVE-2026-71290

Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicyBUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonat...

CVE-2026-71290

Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicyBUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonat...

UBUNTU-CVE-2026-71290

Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicyBUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonat...

CVE-2026-71290 Apache HttpComponents Client: TLS hostname verification silently disabled on the async transport (default config, MITM)

Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicyBUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonat...

CVE-2026-71290

CVE-2026-71290 affects Apache HttpComponents Client 5.4+ where TLS hostname verification is silently disabled for the async transport when using HostnameVerificationPolicy#BUILTIN. An attacker capable of intercepting/modifying traffic can impersonate the server by presenting a valid certificate f...

EUVD-2026-56973

Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicyBUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonat...

CVE-2026-71290

Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicyBUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonat...

CVE-2026-71290

Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicyBUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonat...