CVE-2026-71290 Overview
CVE-2026-71290 is an improper TLS certificate validation vulnerability [CWE-295] in Apache HttpComponents Client 5.4 or newer. The HostnameVerificationPolicy#BUILTIN setting has no effect when applied to the asynchronous version of HttpClient. An attacker positioned to intercept and modify network traffic between the client and server can impersonate the server by presenting a valid certificate issued for a different domain. The classic (synchronous) version of HttpClient is not affected. Apache recommends upgrading to version 5.6.4 or later, which restores hostname verification for async clients.
Critical Impact
A network-adjacent attacker can perform machine-in-the-middle attacks against async HTTP clients, decrypting and modifying TLS-protected traffic without triggering certificate errors.
Affected Products
- Apache HttpComponents Client version 5.4 and later (async HttpClient only)
- Applications configured with HostnameVerificationPolicy#BUILTIN using the async API
- Java-based services and libraries embedding the affected async client
Discovery Timeline
- 2026-08-11 - CVE-2026-71290 published to NVD
- 2026-08-13 - Last updated in NVD database
Technical Details for CVE-2026-71290
Vulnerability Analysis
Apache HttpComponents Client exposes a configurable hostname verification policy through HostnameVerificationPolicy. The BUILTIN option delegates hostname verification to the JDK's TLS implementation during the handshake. In the async client introduced in the 5.x branch, this setting is silently ignored. The result is that no hostname check runs at either the JSSE layer or the library layer, leaving TLS sessions vulnerable to server impersonation.
An attacker with network position, such as on a compromised Wi-Fi network, a hostile ISP, or via BGP or DNS manipulation, can terminate TLS with any certificate signed by a trusted certificate authority. The client accepts the certificate as long as the chain validates, regardless of the Subject Alternative Name or Common Name presented. This defeats a core guarantee of TLS.
Root Cause
The root cause is a missing wiring of the BUILTIN hostname verification policy into the async request execution path. The classic blocking client applies hostname verification correctly, but the async pipeline does not invoke the verifier when this policy is selected. Applications assuming parity between the two clients inherit an insecure default.
Attack Vector
Exploitation requires network-level interception between the affected client and its intended server. The attacker presents a certificate valid for a domain they legitimately control, signed by any CA in the client's trust store. Because hostname matching is skipped, the async client completes the handshake and exchanges request and response data with the attacker-controlled endpoint. The attacker can read credentials, session tokens, and API payloads, and can inject responses back to the client.
No authenticated code examples or public proofs of concept are referenced in the advisory. For technical specifics, refer to the Apache Security Mailing List Post.
Detection Methods for CVE-2026-71290
Indicators of Compromise
- Unexpected TLS certificate chains observed on connections from services using Apache HttpAsyncClient 5.4 through 5.6.3
- Application logs showing successful HTTPS calls to hostnames that do not match the presented certificate's SAN
- Outbound connections from Java processes to IP addresses that do not resolve from the intended DNS name
Detection Strategies
- Inventory Java applications and identify dependencies on org.apache.httpcomponents.client5:httpclient5 versions 5.4 through 5.6.3
- Search source code and configuration for use of HostnameVerificationPolicy.BUILTIN combined with HttpAsyncClient or CloseableHttpAsyncClient
- Use software composition analysis tooling to flag vulnerable artifact versions in build manifests and container images
Monitoring Recommendations
- Capture and inspect TLS metadata at egress proxies, alerting on certificate SAN or CN values that do not match the requested Host header
- Monitor for anomalous DNS responses or ARP table changes in environments running affected Java workloads
- Enable JSSE debug logging (-Djavax.net.debug=ssl,handshake) in non-production to validate that hostname verification runs after upgrade
How to Mitigate CVE-2026-71290
Immediate Actions Required
- Upgrade Apache HttpComponents Client to version 5.6.4 or later across all applications and container images
- Audit all uses of HttpAsyncClient configured with HostnameVerificationPolicy.BUILTIN and confirm remediation after upgrade
- Rotate any credentials, API keys, or session tokens transmitted by affected async clients over untrusted networks
Patch Information
Apache has fixed the vulnerability in Apache HttpComponents Client version 5.6.4. The fix restores hostname verification enforcement in the async execution path when HostnameVerificationPolicy#BUILTIN is selected. See the Apache Security Mailing List Post for the official disclosure.
Workarounds
- Switch affected code paths to HostnameVerificationPolicy.CLIENT, which is enforced by the library directly rather than the JSSE layer
- Migrate temporarily to the classic synchronous HttpClient, which is not affected
- Pin outbound TLS connections to a controlled egress proxy that performs independent certificate and hostname validation
# Maven dependency update to the fixed version
# pom.xml
# <dependency>
# <groupId>org.apache.httpcomponents.client5</groupId>
# <artifactId>httpclient5</artifactId>
# <version>5.6.4</version>
# </dependency>
mvn versions:set-property -Dproperty=httpclient5.version -DnewVersion=5.6.4
mvn dependency:tree | grep httpclient5
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
