Veille CVE

Mardi 11 août 2026

2 CVE

Critique 1 Élevée 0 Moyenne 1 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Apache http server » ✕
  1. CVE-2026-71290 9.1 Critique

    Apache Software Foundation Apache HttpComponents Client · Apache httpclient

    Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicy#BUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonate the server by presenting a valid certificate for a different domain.  Please note the classic version of HttpClient is not affected by this vulnerability.  Affected users are recommended to upgrade to at least version 5.6.4, which fixes the issue.

  2. CVE-2026-14180 5.3 Moyenne

    Red Hat JBoss Enterprise Application Platform 8.1.8.GA · Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10 · Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 · Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9

    A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by WildFly and JBoss EAP to handle chunked transfer encoding. The issue occurs because the parser uses a single internal variable to store both the remaining chunk size and state flags. By sending a specially crafted request with an extremely large chunk size, an attacker can cause these values to overlap, tricking the parser into thinking a request has finished prematurely. This can allow a second, "smuggled" request to be processed out of sync, potentially bypassing security controls.