Improper validation of certificate with host mismatch in Apache HttpComponents Client - CVE-2026-71290

Vulnerability identifier: #VU144886

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-71290

CWE-ID: CWE-297

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to impersonate the server.

The vulnerability exists due to improper certificate validation in the async transport of HttpClient when establishing TLS connections with HostnameVerificationPolicy#BUILTIN. A remote attacker can intercept and modify traffic and present a valid certificate for a different domain to impersonate the server.

The classic version of HttpClient is not affected.

Apache HttpComponents Client
IBM App Connect Enterprise
IBM Content Navigator
IBM Sterling Control Center
IBM Maximo Application Suite - Manage Component
IBM Maximo Scheduler Optimization

Install security update from vendor's website.

Apache HttpComponents Client - update to 5.6.4
IBM Content Navigator - addressed in versions 3.1.0 IF013, 3.2.0 IF008, 26.0.0 IF003
IBM Sterling Control Center - update to 6.4.2.0.7
IBM Maximo Application Suite - Manage Component - addressed in versions 9.0.32, 9.1.25, 9.2.4
IBM Maximo Scheduler Optimization - addressed in versions 9.0.27, 9.1.16
IBM App Connect Enterprise - update to 13.0.8.2

• https://lists.apache.org/api/email.lua?id=oo72fzbhjzg184rn0v0d3px6ddz2pd7r
• https://lists.apache.org/thread/bhf7g2zwpom2ohvwjjjlonc93br2s8vq

• Improper validation of certificate with host mismatch in Apache HttpComponents Client
• Multiple vulnerabilities in IBM App Connect Enterprise
• IBM Maximo Scheduler Optimization update for Apache HttpComponents Client
• IBM Sterling Control Center in Apache HttpComponents Client
• Multiple vulnerabilities in IBM Content Navigator
• IBM Maximo Application Suite - Manage Component update for Apache HttpComponents Client