Httpclient vulnerabilities

3 known vulnerabilities in Httpclient from Apache. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.1 Critical severity

  Apache HttpComponents Client: Improper Certificate Validation

  CVE-2026-71290Aug 11, 2026Apache

  Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicy#BUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between th

• 7.3 High severity

  Apache HttpClient: Missing Critical Step in Authentication

  CVE-2026-40542Apr 22, 2026Apache

  Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper mutual authentication verification. Users are recommended to upgrade to version 5.6.1, which fixes thi

• 7.5 High severity

  Apache HttpComponents: Improper Certificate Validation

  CVE-2025-27820Apr 24, 2025Apache

  A bug in PSL validation logic in Apache HttpClient 5.4.x disables domain checks, affecting cookie management and host name verification. Discovered by the Apache HttpClient team. Fixed in the 5.4.3 release