{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"httpcomponents-core5","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:14","exploited":false,"fixed_versions":[],"id":"tcs_01M5NTY27PMS0215KXBDT41XGM","modified_at":"2026-10-25T09:47:37.296220138Z","published_at":"2026-08-11T21:17:51.157Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2026-71290","https://security-tracker.debian.org/tracker/CVE-2026-71290"],"severity":{"label":"critical","score":9.1},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2026-71290","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2026-71290"}],"summary":"Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicy#BUILTIN setting has no effect when used with the async version of HttpClient."}