CVE-2026-71290: Apache HttpClient Flaw Lets Attackers Intercept and Modify Traffic (CVSS 9.1)

TL;DR: Apache disclosed two Apache HttpClient TLS vulnerabilities in its HttpComponents Client library this month. The more severe, CVE-2026-71290, carries a CVSS score of 9.1 and lets an attacker intercept and modify traffic to impersonate a server. CVE-2026-64607 can exhaust a connection pool instead.

Why It Matters

CVE-2026-71290 disables hostname checking on HttpClient’s async transport, even with the built-in policy enabled. An attacker on the network path can present a certificate for a different domain and pass verification anyway. Only applications using the async transport face this Apache HttpClient TLS vulnerability, since the classic transport still checks hostnames correctly. This kind of bug matters most for services that talk to external APIs over public networks. CVE-2026-64607 poses a smaller risk: it only degrades availability by draining a client’s connection pool.

How the Attack Works

The async transport ignores its own HostnameVerificationPolicy setting, so HttpClient never checks whether the certificate matches the requested host. An attacker between client and server can present any valid certificate, even for an unrelated domain, and the connection proceeds. The classic transport is not affected. CVE-2026-64607 stems from a separate bug: the classic client fails to release a connection when a response carries an invalid Content-Encoding header, eventually exhausting the pool.

Affected Versions

CVE-2026-71290 affects the async transport in HttpComponents Client 5.4-alpha through 5.6.3. CVE-2026-64607 affects the classic transport in versions 5.0-alpha1 through 5.6.2. Version 5.6.4 fixes the TLS bypass and also moves past the range affected by the connection leak.

Patch and Mitigation Steps

Update HttpComponents Client to 5.6.4 or newer from the official Apache download page. Teams that cannot update right away should avoid the async transport on untrusted networks. Watch for repeated ‘Timeout waiting for connection from pool’ errors, a sign of the leak in older classic-transport deployments. No source has confirmed public exploitation of either CVE at the time of writing.

Support Our Threat Intelligence

If you find our CVE report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.