Critical TLS Hostname Verification Flaw in Apache HttpComponents Client
Summary
DEBIAN-CVE-2026-71290: Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicy#BUILTIN setting has no effect when used with the async version of HttpClient. Affects httpcomponents-client versions 4.5.13-2 – 4.5.14-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache HttpComponents Client is a widely-used library for building HTTP clients in Java. It provides essential features for handling HTTP requests and responses, including connection management, cookie handling, and authentication. The library is crucial for applications that require reliable communication over the web. However, a recent vulnerability has been identified that compromises the security of the library when used in asynchronous mode.
Vulnerability Detail
The vulnerability arises from improper TLS hostname verification in Apache HttpComponents Client version 5.4 and newer. Specifically, the HostnameVerificationPolicy#BUILTIN setting is ineffective when the async version of HttpClient is utilized. This flaw allows an attacker who can intercept and modify traffic between the client and server to impersonate the server by presenting a valid certificate for a different domain. This could lead to severe security implications, including data breaches and unauthorized access to sensitive information.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the async version of HttpClient until the upgrade is applied. Additionally, implementing custom hostname verification logic may help mitigate the risk until a proper fix is in place.
Conclusion
The improper TLS hostname verification vulnerability in Apache HttpComponents Client poses significant risks to applications using the library. It is crucial for users to upgrade to the patched version 5.6.4 or later to mitigate these risks. Understanding the nature of this vulnerability and taking appropriate actions can help safeguard applications against potential attacks.
See every vulnerability recorded for httpcomponents-client →
FAQ
The CVSS score for this vulnerability is 9.1, indicating a critical level of severity.
Versions 5.4 and newer of Apache HttpComponents Client are affected by this vulnerability.
No, the classic version of HttpClient is not affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If an immediate upgrade is not possible, consider avoiding the async version of HttpClient and implementing custom hostname verification as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for httpcomponents-client.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
