Description

Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicy#BUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonate the server by presenting a valid certificate for a different domain.  Please note the classic version of HttpClient is not affected by this vulnerability.  Affected users are recommended to upgrade to at least version 5.6.4, which fixes the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-11T21:17:51.157Z",
  "pubdate": "2026-08-11T21:17:51.157Z",
  "executiveSummary": "An improper TLS hostname verification vulnerability exists in Apache HttpComponents Client 5.4 or newer, specifically affecting the asynchronous implementation of HttpClient.\nThe vulnerability arises because the HostnameVerificationPolicy#BUILTIN setting has no operational effect when utilized with the async version of the client.\nConsequently, vulnerable systems fail to properly validate that the presented TLS certificate matches the expected target server domain during the cryptographic handshake.\nAn unauthenticated network attacker capable of intercepting and modifying transit traffic can successfully execute a man-in-the-middle attack.\nBy presenting a cryptographically valid X.509 certificate issued for an arbitrary or different domain, the attacker can impersonate the legitimate server.\nThis failure in trust validation allows the interception, decryption, and potential tampering of sensitive data exchanged between the client application and the remote service.\nThe classic version of HttpClient remains entirely unaffected by this flaw.\nRisk implications include severe confidentiality and integrity breaches for applications relying on asynchronous HTTP communications.\nAffected users are strongly urged to upgrade to version 5.6.4 or later to remediate the flaw.",
  "technicalDetails": "The vulnerability is classified as an improper TLS hostname verification flaw localized within the asynchronous HTTP transport architecture of Apache HttpComponents Client.\nThe root cause stems from a software logic defect where the HostnameVerificationPolicy#BUILTIN configuration directive is ignored during the initialization or execution lifecycle of the async HttpClient component.\nWhile developers explicitly configure the client to enforce strict hostname checking via HostnameVerificationPolicy#BUILTIN, the underlying asynchronous connection establishment routines fail to evaluate the subject alternative name (SAN) or common name (CN) attributes of the server certificate against the intended request URI host.\nThe vulnerable component is exclusively the asynchronous implementation of Apache HttpComponents Client versions 5.4 and newer.\nThe classic synchronous implementation of HttpClient does not exhibit this behavior and correctly applies the designated hostname verification policies.\nExploitation requires network positioning that permits traffic interception, typically achieved via active man-in-the-middle capabilities such as ARP poisoning, rogue Wi-Fi access points, or compromised routing infrastructure.\nNo authentication or elevated privileges are required for an external network attacker to initiate the interception.\nDuring the exploitation process, the client initiates an asynchronous TLS handshake with the targeted remote server.\nThe attacker intercepts the connection negotiation and interposes a proxy.\nWhen the attacker presents a valid TLS certificate issued by a trusted certificate authority for a completely unrelated domain, the vulnerable asynchronous client accepts the certificate unconditionally because hostname validation is bypassed.\nThe TLS session is successfully established between the client and the attacker-controlled proxy, while a separate session is maintained with the legitimate server if necessary.\nPost-exploitation impact includes the transparent interception of application-layer payloads, leakage of sensitive credentials or tokens transmitted over the connection, and potential injection of malicious responses into the client application data stream."
}