Apache Software Foundation Apache HttpComponents Client Schwachstellen (CVE)

Für Apache Software Foundation Apache HttpComponents Client veröffentlichte CVE-Einträge, neueste zuerst. Folgen Sie, um bei neuen Einträgen eine E-Mail zu erhalten.

2 Ergebnisse

9.1Kritisch

CVE-2026-71290 vor 3 Monaten

Apache HttpComponents Client: TLS hostname verification silently disabled on the async transport (default config, MITM)

Apache Software Foundation Apache HttpComponents Client

Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicy#BUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between t…

5.3Mittel

CVE-2026-64607 vor 3 Monaten

Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS

Apache Software Foundation Apache HttpComponents Client

HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-Encoding` header value in the response message. Please note this defect does not …