THE article discusses two critical vulnerabilities found in the Apache HttpClient library. The more severe flaw, CVE-2026-71290, has a CVSS score of 9.1, allowing attackers to intercept and modify traffic by disabling hostname verification on the async transport. The second vulnerability, CVE-2026-64607, carries a CVSS score of 5.3 and leads to connection pool exhaustion. Both vulnerabilities have patches available, and users are advised to update to version 5.6.4 immediately.
The async transport flaw is particularly concerning for services communicating over public networks. In the exploit scenario, an attacker can present a fake certificate, resulting in potential data compromises. No confirmed exploitation has been reported yet.