The updated CVE description indicates that an attacker who can intercept traffic between the Apache HttpComponents Client and a server can bypass TLS hostname verification in the async transport by presenting a valid certificate for a different domain. This flaw removes the core assurance of TLS that the presented certificate corresponds to the intended host, allowing a MITM to impersonate the server and read or modify traffic without detection.

Apache HttpComponents Client 5.4 through 5.6.3 is affected. The classic (non‑async) HttpClient is not impacted. Users running any of the vulnerable async clients should upgrade to at least version 5.6.4, which contains the fix.

An active network attacker who can intercept traffic between the client and server can exploit this flaw. Although the EPSS score is below 1%, indicating current exploitation probability is low, the impact of a successful attack is severe because TLS assurance is compromised. The vulnerability is not listed in the CISA KEV catalog, but organizations using the vulnerable client should aim to remediate quickly as the attack vector—MITM—is straightforward and requires only control over network traffic or DNS manipulation. The CVSS score of 9.1 indicates high severity.