Vulnerabilidades de Apache Software Foundation Apache HttpComponents Client (CVE)

Registros CVE publicados para Apache Software Foundation Apache HttpComponents Client, los más recientes primero. Siga el producto para recibir un correo con cada nueva.

2 resultados

9.1Crítica

CVE-2026-71290 hace 3 meses

Apache HttpComponents Client: TLS hostname verification silently disabled on the async transport (default config, MITM)

Apache Software Foundation Apache HttpComponents Client

Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicy#BUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between t…

5.3Media

CVE-2026-64607 hace 3 meses

Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS

Apache Software Foundation Apache HttpComponents Client

HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-Encoding` header value in the response message. Please note this defect does not …