Critical Apache HttpComponents Flaw Allows Server Impersonation in MITM Attacks
Brief
A critical vulnerability in Apache HttpComponents Client could allow attackers to impersonate trusted servers during man-in-the-middle (MITM) attacks when applications use the asynchronous HttpClient implementation.
Tracked as CVE-2026-71290, the issue stems from improper TLS hostname verification in Apache HttpComponents Client versions 5. 4 through 5.
- 3.
The vulnerability affects applications configured with HostnameVerificationPolicy#BUILTIN while using the async version of Apache HttpClient.
Critical Apache HttpComponents Flaw
Although the setting is intended to enforce hostname validation during a TLS handshake , it reportedly has no effect in vulnerable async configurations.
TLS hostname verification is a critical control that confirms whether the hostname requested by a client matches the identity listed in the server’s TLS certificate.