RHLW-2026-e56fd5f91f882db9

See a problem?
Please try reporting it to the source first.
Source
https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-e56fd5f91f882db9.json
Import Source
https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-e56fd5f91f882db9.json
JSON Data
https://api.test.osv.dev/v1/vulns/RHLW-2026-e56fd5f91f882db9
Upstream
Published
2026-10-08T19:45:54Z
Modified
2026-10-22T00:08:25Z
Severity
  • 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
Lightwell Security Advisory: httpclient5-cache 5.6.2.rhlw-00005
Details

Red Hat Lightwell has released org.apache.httpcomponents.client5:httpclient5-cache 5.6.2.rhlw-00005 with a backported security fix.

CVE-2026-71290: Apache HttpComponents Client: TLS hostname verification silently disabled on the async transport (default config, MITM)

This patched artifact is a drop-in replacement for org.apache.httpcomponents.client5:httpclient5-cache 5.6.2 from Maven Central.

References
Credits
    • Red Hat Lightwell - REMEDIATION_DEVELOPER

Affected packages

Red Hat Lightwell:Maven / org.apache.httpcomponents.client5:httpclient5-cache

Package

Name
org.apache.httpcomponents.client5:httpclient5-cache
Purl
pkg:maven/org.apache.httpcomponents.client5/httpclient5-cache

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
5.6.2.rhlw-00005

Affected versions

5.*
5.0-alpha1
5.0-alpha2
5.0-alpha3
5.0-beta1
5.0-beta2
5.0-beta3
5.0-beta4
5.0-beta5
5.0-beta6
5.0-beta7
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.1-beta1
5.1
5.1.1
5.1.2
5.1.3
5.1.4
5.2-alpha1
5.2-beta1
5.2
5.2.1
5.2.2
5.2.3
5.3-alpha1
5.3
5.3.1
5.4-alpha1
5.4-alpha2
5.4-beta1
5.4
5.4.1
5.4.2
5.4.3
5.4.4
5.5-alpha1
5.5
5.5.1
5.5.2
5.6-alpha1
5.6
5.6.1
5.6.2

Database specific

lightwell 
{
    "backport_base_version": "5.6.2",
    "remediated_version": "5.6.2.rhlw-00005",
    "repository_url": "https://packages.redhat.com/lightwell/java/remediated/"
}
source 
"https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-e56fd5f91f882db9.json"