Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicy#BUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonate the server by presenting a valid certificate for a different domain. Please note the classic version of HttpClient is not affected by this vulnerability. Affected users are recommended to upgrade to at least version 5.6.4, which fixes the issue.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-08-18 | 2 | Disclosure1Patch1 |
| 2026-08-19 | 2 | Disclosure2 |
| 2026-08-25 | 1 | Patch1 |
| 2026-08-27 | 1 | Disclosure1 |
CVE-2026-71290 (CVSS 9.1) is an Apache HttpClient TLS vulnerability that lets attackers intercept and modify traffic via MITM attacks. Update to 5.6.4. #ApacheHttpClient #CVE202671290 #MITM #InfoSec https://securityonline.info/apache-httpclient-cve-2026-71290/
Post summary
Apache HttpClient TLS vulnerability CVE-2026-71290 is disclosed with CVSS 9.1, and users are advised to update to version 5.6.4 to mitigate the risk.
Apache HttpComponents Clientで2件の脆弱性が公開された。CVE-2026-71290では非同期トランスポートのTLSホスト名検証が無効化され、中間者攻撃で別ドメイン用の証明書でも接続が成立する。CVE-2026-64607では接続プール枯渇が発生する。 CVE-2026-71290は5.4-alphaから5.6.3までの非同期トランスポートに影響し、HostnameVerificationPolicyを有効にしていても要求先ホスト名と証明書の一致を確認しない。クラシックトランスポートは影響を受けない。CVE-2026-64607は5.0-alpha1から5.6.2までのクラシッククライアントに影響し、不正なContent-Encodingヘッダーを含む応答で接続が解放されず、最終的にプールを使い果たす。Apache HttpComponents Client 5.6.4では両問題の影響範囲を外れる。記事執筆時点で、いずれの脆弱性についても公開された悪用事例は確認されていない。 https://securityonline.info/apache-httpclient-cve-2026-71290/
Post summary
The article announces two CVEs affecting Apache HttpComponents Client, details their technical impact, notes no active exploitation, and indicates that version 5.6.4 no longer suffers from the issues.
Apache HttpComponents Client の脆弱性 CVE-2026-71290 が FIX：中間者攻撃の恐れ https://iototsecnews.jp/2026/08/19/critical-apache-httpcomponents-client-flaw-lets-attackers-impersonate-servers/ Apache HttpComponents Client の非同期通信において、TLS ホスト名検証が正常に機能しないという不具合が確認されました。通信経路上の第三者による送信データの不法解読 ／ API レスポンスの改ざん ／ 認証情報の不正取得といった重大な被害につながる恐れがあります。この脆弱性は CVE-2026-71290 として管理されています。影響を受ける環境の特定および Apache HttpComponents Client 5.6.4 以降への速やかなアップデートが求められます。 #Apache #CVE202671290 #HttpComponentsClient #Vulnerability
Post summary
Apache HttpComponents Client suffers from a TLS hostname verification flaw (CVE‑2026‑71290) that could enable MITM attacks; vendors are urged to update to version 5.6.4 or newer.
New Apache HttpComponents Client TLS bypass (CVE-2026-71290) enables MitM, severely compromising data privacy & integrity in transit. Patch immediately! (Aug 24, 2026) #Cybersecurity #Vulnerabilities #News
Post summary
The tweet announces the discovery of CVE-2026-71290, a TLS bypass in Apache HttpComponents Client that permits MITM attacks, and urges immediate patching.
CyberSignal Daily ✓ · 🔐 Application Security · August 19, 2026 🎯 Encryption isn't enough if software verifies the wrong server. August 19 coverage highlights CVE-2026-71290, a critical vulnerability in Apache HttpComponents Client involving improper TLS hostname verification. Under vulnerable configurations, an attacker in a suitable network position could potentially impersonate a trusted server despite the connection using TLS. CISA/NVD enrichment currently indicates no known exploitation, while patched releases are available. 🔗 Sources: Apache / NVD / GBHackers #Apache #TLS #CVE #AppSec #Java #CyberSecurity
Post summary
The post announces CVE-2026-71290, a critical TLS hostname verification flaw in Apache HttpComponents Client, and notes that vendor patches are available.
CVE-2026-71290：Apache HttpClientの脆弱性により、攻撃者がトラフィックを傍受および改ざんできる（CVSS 9.1） CVE-2026-71290: Apache HttpClient Flaw Lets Attackers Intercept and Modify Traffic (CVSS 9.1) #DailyCyberSecurity (Aug 18) https://securityonline.info/apache-httpclient-cve-2026-71290/
Post summary
The post announces CVE-2026-71290, a high‑severity Apache HttpClient flaw that permits traffic interception and modification, with a CVSS 9.1 rating.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | apache | httpclient | - | - | - |