This vulnerability involves improper TLS hostname verification in the async version of Apache HttpComponents Client starting from version 5.4-alpha. Specifically, the HostnameVerificationPolicy#BUILTIN setting does not function as intended, enabling a man-in-the-middle attacker to impersonate a legitimate server by presenting a valid certificate issued for a different domain. The classic HttpClient is unaffected. The vendor recommends upgrading to at least version 5.6.4 where the issue is fixed.

An attacker capable of intercepting and modifying traffic between the client and server can impersonate the server by presenting a valid certificate for a domain other than the intended one. This undermines the trust model of TLS, potentially leading to sensitive data exposure or session hijacking. The impact is limited to the async HttpClient in affected versions; the classic HttpClient is not vulnerable.

Users should upgrade Apache HttpComponents Client to version 5.6.4 or later, where this vulnerability is fixed. No other mitigation or temporary workaround is indicated. Patch status is not explicitly stated but the vendor recommends upgrading to 5.6.4, which implies an official fix is available in that version.