Advisories · Technology

Apache Software Foundation Apache HttpComponents Client.

Every CVE that names Apache Software Foundation Apache HttpComponents Client among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-71290 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Apache HttpComponents Client: TLS hostname verification silently disabled on the async transport (default config, MITM)
- Apache Software Foundation Apache HttpComponents Client
- Weak cryptography or TLS
Not analysed yet 11 Aug 2026