Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer.

Apache HttpComponents Client versions 5.4 through 5.6.3 contain a bug where the HostnameVerificationPolicy#BUILTIN setting is silently ignored on the async transport (CloseableHttpAsyncClient). The classic (blocking) CloseableHttpClient is not affected. In practice, any Java application using the async API over HTTPS will accept a TLS certificate issued for *any* domain, enabling a man-in-the-middle attacker with network position to intercept or modify traffic. The fix landed in version 5.6.4.

Apache scored this CVSS 9.1 CRITICAL with AV:N/AC:L/PR:N/UI:N, which overstates the real-world risk. The vector treats the attack as though a remote unauthenticated adversary can exploit it directly — but the prerequisite is a man-in-the-middle position on the network path between client and server, which implies prior network compromise, DNS hijacking, or a privileged vantage point. Additionally, only applications using the *async* API are vulnerable; the majority of enterprise Java code still relies on the classic blocking API. The vendor severity does not account for either friction point.

Why this verdict

• MITM prerequisite compounds attack complexity: The CVSS vector scores AV:N/AC:L, but real-world exploitation requires the attacker to already hold a network interception position (ARP spoof, DNS hijack, compromised proxy). This is effectively AC:H, which alone drops the score from 9.1 to ~7.4.
• Async-only scope narrows the vulnerable population: The classic (blocking) CloseableHttpClient — which is the dominant usage pattern in enterprise Java — is unaffected. Only applications explicitly using CloseableHttpAsyncClient are vulnerable, estimated at <30% of httpclient5 consumers.
• No exploitation evidence or weaponized tooling: EPSS is 0.00187 (9th percentile), no KEV listing, no public PoC, no campaigns observed. The bug is a silent regression, not a weaponizable primitive that scales.
• Role multiplier: Apache HttpComponents Client 5.x is a general-purpose Java HTTP library, not a canonically high-value-role component. However, it appears as a transitive dependency in CI/CD tooling (Maven/Gradle plugin HTTP transports), data platform clients (Apache Iceberg REST catalog), and microservice frameworks. In CI/CD contexts, MITM on artifact fetches could enable supply-chain poisoning — this keeps the floor at HIGH. In typical application-server roles, the blast radius is limited to the data transiting that single service's outbound connections (host-level, not fleet-level).

Why not higher?

CRITICAL would require either active exploitation, a directly reachable attack surface without prerequisites, or a canonically high-value-role component where ≥10% of installs occupy that role. This CVE has none of those: the MITM prerequisite is a hard gate, no exploitation exists, and the library is general-purpose with only incidental high-value-role exposure via transitive dependencies.

Why not lower?

MEDIUM would undercount the supply-chain risk surface. Apache HttpComponents Client 5.x is one of the most widely used Java HTTP libraries, and the async API is gaining adoption with HTTP/2 and reactive frameworks. A successful MITM against a CI/CD pipeline or artifact-fetching service using the async client could yield fleet-scale compromise via poisoned builds. The complete absence of hostname verification (not a partial bypass) also means exploitation, once positioned, is trivial.

1. Audit your SBOM for httpclient5 async API usage — Run SCA tooling (Snyk, Trivy, Dependabot) across all Java services to identify which applications import CloseableHttpAsyncClient from httpclient5 5.4–5.6.3. Prioritize CI/CD pipelines and data platform clients. Complete within the noisgate mitigation SLA of 30 days.
2. Pin or upgrade httpclient5 to ≥5.6.4 — The simplest fix is a dependency version bump. For Maven: update <version> in your POM; for Gradle: update the dependency declaration. Test for behavioral changes in TLS handling. Deploy within 30 days per noisgate mitigation SLA.
3. Enforce network segmentation and ARP protections — Enable DHCP snooping, dynamic ARP inspection, and 802.1X on segments hosting affected services to prevent the MITM prerequisite. In cloud, use private endpoints and VPC service endpoints to eliminate network-path interception opportunities.
4. Switch affected services to classic HttpClient API as an interim measure — If upgrading the library is blocked by compatibility testing, refactor the HTTP call sites from CloseableHttpAsyncClient to CloseableHttpClient (blocking). The classic API is unaffected by this CVE. This is a code change, so scope it to the most critical services first.

Run this on any host where your Java application is deployed, or in your CI pipeline. It scans the application's classpath JARs for the affected httpclient5 version. Requires read access to the application's lib directory. Example: bash check_cve_2026_71290.sh /opt/myapp/lib

#!/usr/bin/env bash
# check_cve_2026_71290.sh — Detect CVE-2026-71290 (Apache HttpComponents Client async TLS bypass)
# Usage: bash check_cve_2026_71290.sh <path-to-lib-directory>
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

LIB_DIR="${1:-}"
if [[ -z "$LIB_DIR" ]]; then
  echo "Usage: $0 <path-to-lib-directory>"
  exit 2
fi

if [[ ! -d "$LIB_DIR" ]]; then
  echo "UNKNOWN — directory $LIB_DIR does not exist"
  exit 2
fi

# Look for httpclient5 JARs
FOUND=0
VULN=0
for jar in "$LIB_DIR"/httpclient5-5.*.jar; do
  [[ -e "$jar" ]] || continue
  FOUND=1
  # Extract version from filename
  VERSION=$(basename "$jar" | sed -n 's/httpclient5-\([0-9.]*\)\.jar/\1/p')
  if [[ -z "$VERSION" ]]; then
    continue
  fi
  # Compare version: affected is 5.4 <= ver < 5.6.4
  MAJOR=$(echo "$VERSION" | cut -d. -f1)
  MINOR=$(echo "$VERSION" | cut -d. -f2)
  PATCH=$(echo "$VERSION" | cut -d. -f3)
  PATCH=${PATCH:-0}
  if [[ "$MAJOR" -eq 5 ]]; then
    if [[ "$MINOR" -ge 4 ]] && [[ "$MINOR" -lt 6 ]]; then
      echo "VULNERABLE — httpclient5-$VERSION (affected: 5.4 <= v < 5.6.4)"
      VULN=1
    elif [[ "$MINOR" -eq 6 ]] && [[ "$PATCH" -lt 4 ]]; then
      echo "VULNERABLE — httpclient5-$VERSION (affected: 5.4 <= v < 5.6.4)"
      VULN=1
    else
      echo "PATCHED — httpclient5-$VERSION (>= 5.6.4)"
    fi
  fi
done

if [[ "$FOUND" -eq 0 ]]; then
  # Also check Maven local repo or Gradle cache
  echo "UNKNOWN — no httpclient5-5.x JARs found in $LIB_DIR"
  echo "Tip: also check ~/.m2/repository/org/apache/httpcomponents/client5/httpclient5/"
  exit 2
fi

if [[ "$VULN" -eq 1 ]]; then
  exit 1
else
  exit 0
fi

Sources

1. GitHub Advisory GHSA-72q8-9rgw-5g6j
2. CVE Feed — CVE-2026-71290 Detail
3. Apache Mailing List Advisory
4. Apache Iceberg Issue #15598 — HTTPClient TLS Regression
5. THREATINT CVE-2026-71290
6. OSS-Security Advisory
7. Apache HttpComponents Client 5.x Migration Guide (Async)