Apache Software Foundation Apache Httpcomponents Client vulnerabilities

2 vulnerabilities

Known vulnerabilities in Apache Software Foundation Apache Httpcomponents Client, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

9.1CVE-2026-71290apache software foundationapache httpcomponents client+6
EPSS score
0.33%
Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicy#BUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonate the server by presenting a valid certificate for a different domain.  Please note the classic version of HttpClient is not affected by this vulnerability.  Affected users are recommended to upgrade to at least version 5.6.4, which fixes the issue.5.3CVE-2026-64607apache software foundationapache httpcomponents client+203
EPSS score
0.46%
HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-Encoding` header value in the response message. Please note this defect does not affect HttpClient based on the async i/o model. This issue affects Apache HttpComponents Client: from 5.0-alpha1 through 5.6.2.