Vulnerabilidades do Apache Software Foundation Httpclient

🔔 Criar alerta RSS Verificador de versão

CVEs publicadas que afetam Apache Software Foundation Httpclient: 4 registro(s), com versões afetadas e correções.
cpe:2.3:a:apache:httpclient

CVE-2026-71290 Crítica · 9.1 CWE-295 11/08/2026

Apache HttpComponents Client: TLS hostname verification silently disabled on the async transport (default config, MITM)

Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicy#BUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonate the server by presenting a valid certificate for a different domain. Please note the classic version of HttpClient is not affected by this vulnerability. Affected users are recommended to upgrade to at least version 5.6.4, which fixes the issue.

CVE-2026-64607 Média · 5.3 CWE-772 31/07/2026

Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS

HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-Encoding` header value in the response message. Please note this defect does not affect HttpClient based on the async i/o model. This issue affects Apache HttpComponents Client: from 5.0-alpha1 through 5.6.2.

CVE-2026-40542 Alta · 7.3 CWE-304 22/04/2026

Apache HttpClient: SCRAM-SHA-256 mutual authentication bypass may cause the client to accept authentication without proper mutual authentication verification

Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper mutual authentication verification. Users are recommended to upgrade to version 5.6.1, which fixes this issue.

CVE-2020-13956 Média · 5.3 CWE-20 02/12/2020

Improper Input Validation em Apache Software Foundation Httpclient

Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.