CVE-2026-71290

A flaw was found in the asynchronous version of Apache HttpComponents Client. This improper Transport Layer Security (TLS) hostname verification vulnerability allows a remote attacker to intercept and modify network traffic. By presenting a valid certificate for a different domain, an attacker can impersonate the server, leading to a Man-in-the-Middle (MITM) attack and compromising communication.

This vulnerability is rated as Important as it allows for server impersonation in Red Hat products utilizing the asynchronous Apache HttpComponents Client. An attacker positioned to intercept and alter network traffic can present a fraudulent server certificate, bypassing TLS hostname verification and potentially leading to man-in-the-middle attacks. This flaw does not affect the classic version of HttpClient.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.