SB20260824163 - Improper validation of certificate with host mismatch in Apache HttpComponents Client

Description

This security bulletin contains information about 1 vulnerability.

1) Improper validation of certificate with host mismatch (CVE-ID: CVE-2026-71290)

CWE-ID: CWE-297 - Improper Validation of Certificate with Host Mismatch

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to impersonate the server.

The vulnerability exists due to improper certificate validation in the async transport of HttpClient when establishing TLS connections with HostnameVerificationPolicy#BUILTIN. A remote attacker can intercept and modify traffic and present a valid certificate for a different domain to impersonate the server.

The classic version of HttpClient is not affected.

Remediation

Install update from vendor's website.

References

• https://lists.apache.org/api/email.lua?id=oo72fzbhjzg184rn0v0d3px6ddz2pd7r
• https://lists.apache.org/thread/bhf7g2zwpom2ohvwjjjlonc93br2s8vq