Reported by 2 outlets

Timeline

1. update from gbhackers.com

   Critical Apache HttpComponents Client Flaw Lets Attackers Impersonate Servers

   gbhackers.com · 55d ago · August 19th, 2026

   A critical vulnerability in the Apache HttpComponents Client can allow man-in-the-middle attackers to impersonate trusted servers when applications use the asynchronous version of HttpClient. This vulnerability is tracked as CVE-2026-71290 and arises from improper TLS hostname verification in Apache HttpComponents Client versions 5.4 through 5.6.3. Apache HttpComponents Client Flaw The issue specifically affects applications configured […] The post Critical Apache HttpComponents Client Flaw Lets Attackers Impersonate Servers appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

2. update from cyberpress.org

   Critical Apache HttpComponents Flaw Allows Server Impersonation in MITM Attacks

   cyberpress.org · 55d ago · August 19th, 2026

   The vulnerability affects applications configured with HostnameVerificationPolicy#BUILTIN while using the async version of Apache HttpClient. Critical Apache HttpComponents Flaw Although the setting is intended to enforce hostname validation during a TLS handshake , it reportedly has no effect in vulnerable async configurations. TLS hostname verification is a critical control that confirms whether the hostname requested by a client matches the identity listed in the server’s TLS certificate. Without this validation, a certificate that is otherwise valid but issued for an unrelated domain may be accepted by the client. An attacker capable of intercepting and modifying traffic between an affected application and its intended destination could exploit this behavior. This could expose API requests, authentication tokens, session data, credentials, and other sensitive information transmitted over HTTPS connections. Attackers may also be able to alter responses in transit,