CVE-2026-71290

Apache HttpComponents Client 5.4 and newer contains an improper TLS hostname verification vulnerability (CWE-295) in the async version of HttpClient. The root cause is that the HostnameVerificationPolicy#BUILTIN setting has no effect, allowing a network attacker to intercept traffic and impersona...

CVE-2026-64607

The Apache HttpComponents Client (versions 5.0-alpha1 through 5.6.2) contains a resource leak vulnerability (CWE-772 ) where the HttpClient based on the classic i/o model fails to release underlying connections back to the connection manager when encountering invalid or unsupported Content-Encodi...

CVE-2026-40542

A missing critical step in the authentication process of Apache HttpClient 5.6 allows an attacker to bypass proper mutual authentication verification during SCRAM-SHA-256 authentication. This vulnerability affects several products, including IBM App Connect Enterprise (v13.0.1.0 - 13.0.7.2), Mong...