Apache Software Foundation Apache HttpComponents Client vulnerabilities (CVE)

CVE records published for Apache Software Foundation Apache HttpComponents Client, newest first. Follow to get an email when a new one appears.

2 results

9.1Critical

CVE-2026-71290 3 months ago

Apache HttpComponents Client: TLS hostname verification silently disabled on the async transport (default config, MITM)

Apache Software Foundation Apache HttpComponents Client

Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicy#BUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between t…

5.3Medium

CVE-2026-64607 3 months ago

Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS

Apache Software Foundation Apache HttpComponents Client

HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-Encoding` header value in the response message. Please note this defect does not …