CVE-2026-64607
Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS
HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. Please note this defect does not affect HttpClient based on the async i/o model.
This issue affects Apache HttpComponents Client: from 5.0-alpha1 through 5.6.2.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS
HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. Please note this defect does not affect HttpClient based on the async i/o model.
This issue affects Apache HttpComponents Client: from 5.0-alpha1 through 5.6.2.
- Record
CVE-2026-64607- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-772
- Updated
- 2026-11-02
EUVDEUVD-2026-51519
HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. Please note this defect does not affect HttpClient based on the async i/o model.
This issue affects Apache HttpComponents Client: from 5.0-alpha1 through 5.6.2.
- Record
EUVD-2026-51519- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-hjcp-jmpx-g3qm
Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS
HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. Please note this defect does not affect HttpClient based on the async i/o model.
This issue affects Apache HttpComponents Client: from 5.0-alpha1 through 5.6.2.
- Record
GHSA-hjcp-jmpx-g3qm- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-772
- Updated
- 2026-11-02
NVD
HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. Please note this defect does not affect HttpClient based on the async i/o model.
This issue affects Apache HttpComponents Client: from 5.0-alpha1 through 5.6.2.
- Record
CVE-2026-64607- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-772
- Updated
- 2026-11-02
OSV
Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS
HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. Please note this defect does not affect HttpClient based on the async i/o model.
This issue affects Apache HttpComponents Client: from 5.0-alpha1 through 5.6.2.
- Record
CVE-2026-64607- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-772
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-64607
HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. Please note this defect does not affect HttpClient based on the async i/o model. This issue affects Apache HttpComponents Client: from 5.0-alpha1 through 5.6.2.
- Record
DEBIAN-CVE-2026-64607- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
Show 16 moreShow less
OSVGHSA-hjcp-jmpx-g3qm
Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS
HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. Please note this defect does not affect HttpClient based on the async i/o model.
This issue affects Apache HttpComponents Client: from 5.0-alpha1 through 5.6.2.
- Record
GHSA-hjcp-jmpx-g3qm- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-772
- Updated
- 2026-11-02
OSVRHLW-2026-2a7b95611000d6b5
Lightwell Security Advisory: httpclient5 5.6.0.rhlw-00001
Red Hat Lightwell has released org.apache.httpcomponents.client5:httpclient5 5.6.0.rhlw-00001 with backported fixes for CVE-2026-40542 and CVE-2026-64607.
CVE-2026-40542: Apache HttpClient: SCRAM-SHA-256 mutual authentication bypass may cause the client to accept authentication without proper mutual authentication verification
CVE-2026-64607: Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS
This patched artifact is a drop-in replacement for org.apache.httpcomponents.client5:httpclient5 5.6.0 from Maven Central.
- Record
RHLW-2026-2a7b95611000d6b5- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVRHLW-2026-32de0f514c232ff5
Lightwell Security Advisory: httpclient5 5.6.2.rhlw-00005
Red Hat Lightwell has released org.apache.httpcomponents.client5:httpclient5 5.6.2.rhlw-00005 with backported fixes for CVE-2026-64607 and CVE-2026-71290.
CVE-2026-64607: Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS
CVE-2026-71290: Apache HttpComponents Client: TLS hostname verification silently disabled on the async transport (default config, MITM)
This patched artifact is a drop-in replacement for org.apache.httpcomponents.client5:httpclient5 5.6.2 from Maven Central.
- Record
RHLW-2026-32de0f514c232ff5- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVRHLW-2026-639f255bd180ae78
Lightwell Security Advisory: httpclient5 5.6.1.rhlw-00026
Red Hat Lightwell has released org.apache.httpcomponents.client5:httpclient5 5.6.1.rhlw-00026 with backported fixes for CVE-2026-64607 and CVE-2026-71290.
CVE-2026-64607: Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS
CVE-2026-71290: Apache HttpComponents Client: TLS hostname verification silently disabled on the async transport (default config, MITM)
This patched artifact is a drop-in replacement for org.apache.httpcomponents.client5:httpclient5 5.6.1 from Maven Central.
- Record
RHLW-2026-639f255bd180ae78- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-06
OSVRHLW-2026-8118b2499151de91
Lightwell Security Advisory: httpclient5 5.6.1.rhlw-00012
Red Hat Lightwell has released org.apache.httpcomponents.client5:httpclient5 5.6.1.rhlw-00012 with a backported security fix.
CVE-2026-64607: Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS
This patched artifact is a drop-in replacement for org.apache.httpcomponents.client5:httpclient5 5.6.1 from Maven Central.
- Record
RHLW-2026-8118b2499151de91- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-64607
HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. Please note this defect does not affect HttpClient based on the async i/o model. This issue affects Apache HttpComponents Client: from 5.0-alpha1 through 5.6.2.
- Record
UBUNTU-CVE-2026-64607- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVCLSA-2026-1786537061 No score
TuxCare security update for org.apache.httpcomponents.client5:httpclient5 (1 CVE)
TuxCare rebuilt org.apache.httpcomponents.client5:httpclient5 to address 1 CVE. Fixed in 5.5.2-tuxcare.1.
- Record
CLSA-2026-1786537061- Updated
- 2026-11-02
OSVCLSA-2026-1789373020 No score
TuxCare security update for org.apache.httpcomponents.client5:httpclient5 (1 CVE)
TuxCare rebuilt org.apache.httpcomponents.client5:httpclient5 to address 1 CVE. Fixed in 5.3.1-tuxcare.1.
- Record
CLSA-2026-1789373020- Updated
- 2026-11-02
OSVCLSA-2026-1789474443 No score
TuxCare security update for org.apache.httpcomponents.client5:httpclient5 (1 CVE)
TuxCare rebuilt org.apache.httpcomponents.client5:httpclient5 to address 1 CVE. Fixed in 5.0.3-tuxcare.1.
- Record
CLSA-2026-1789474443- Updated
- 2026-11-02
OSVCLSA-2026-1792743499 No score
TuxCare security update for org.apache.httpcomponents.client5:httpclient5 (1 CVE)
TuxCare rebuilt org.apache.httpcomponents.client5:httpclient5 to address 1 CVE. Fixed in 5.1.4-tuxcare.1.
- Record
CLSA-2026-1792743499- Updated
- 2026-11-02
OSVCLSA-2026-1792743815 No score
TuxCare security update for org.apache.httpcomponents.client5:httpclient5 (1 CVE)
TuxCare rebuilt org.apache.httpcomponents.client5:httpclient5 to address 1 CVE. Fixed in 5.2.3-tuxcare.1.
- Record
CLSA-2026-1792743815- Updated
- 2026-11-02
OSVCLSA-2026-1792744283 No score
TuxCare security update for org.apache.httpcomponents.client5:httpclient5 (1 CVE)
TuxCare rebuilt org.apache.httpcomponents.client5:httpclient5 to address 1 CVE. Fixed in 5.1.3-tuxcare.1.
- Record
CLSA-2026-1792744283- Updated
- 2026-11-02
OSVCLSA-2026-1792745046 No score
TuxCare security update for org.apache.httpcomponents.client5:httpclient5 (2 CVEs)
TuxCare rebuilt org.apache.httpcomponents.client5:httpclient5 to address 2 CVEs. Fixed in 5.4.4-tuxcare.1.
- Record
CLSA-2026-1792745046- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11647-1 No score
httpcomponents-client-4.5.14-2.1 on GA media
These are all security issues fixed in the httpcomponents-client-4.5.14-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11647-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:21894-1 No score
Security update for httpcomponents-client
This update for httpcomponents-client fixes the following issue:
- CVE-2026-64607: improper release of underlying connection back to connection manager when an invalid or unsupported
Content-Encodingheader value in a response message (bsc#1273163).
- Record
openSUSE-SU-2026:21894-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:4028-1 No score
Security update for httpcomponents-client
This update for httpcomponents-client fixes the following issue:
- CVE-2026-64607: improper release of underlying connection back to connection manager when an invalid or unsupported
Content-Encodingheader value in a response message (bsc#1273163).
- Record
SUSE-SU-2026:4028-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.httpcomponents.client5:httpclient5Maven |
5.0-alpha1 up to 5.6.3 | 5.6.3 |
org.apache.httpcomponents.client5:httpclient5TuxCare:Maven |
5.5.2 up to 5.5.2-tuxcare.1 | 5.5.2-tuxcare.1 |
org.apache.httpcomponents.client5:httpclient5TuxCare:Maven |
5.3.1 up to 5.3.1-tuxcare.1 | 5.3.1-tuxcare.1 |
org.apache.httpcomponents.client5:httpclient5TuxCare:Maven |
5.0.3 up to 5.0.3-tuxcare.1 | 5.0.3-tuxcare.1 |
org.apache.httpcomponents.client5:httpclient5TuxCare:Maven |
5.1.4 up to 5.1.4-tuxcare.1 | 5.1.4-tuxcare.1 |
org.apache.httpcomponents.client5:httpclient5TuxCare:Maven |
5.2.3 up to 5.2.3-tuxcare.1 | 5.2.3-tuxcare.1 |
org.apache.httpcomponents.client5:httpclient5TuxCare:Maven |
5.1.3 up to 5.1.3-tuxcare.1 | 5.1.3-tuxcare.1 |
org.apache.httpcomponents.client5:httpclient5TuxCare:Maven From an advisory covering 2 CVEs |
5.4.4 up to 5.4.4-tuxcare.1 | 5.4.4-tuxcare.1 |
commons-httpclientDebian:12 |
All versions, plus listed versions 3.1-16 |
None known |
commons-httpclientDebian:13 |
All versions, plus listed versions 3.1-16 |
None known |
Show 28 moreShow less
| Package | Affected | Fixed |
|---|---|---|
commons-httpclientDebian:14 |
All versions, plus listed versions 3.1-16 |
None known |
httpcomponents-clientDebian:12 |
All versions, plus listed versions 4.5.14-1 |
None known |
httpcomponents-clientDebian:13 |
All versions, plus listed versions 4.5.14-1 |
None known |
httpcomponents-clientDebian:14 |
All versions, plus listed versions 4.5.14-1 |
None known |
org.apache.httpcomponents.client5:httpclient5Maven |
5.0-alpha1 up to 5.6.3, plus listed versions 5.05.0-alpha25.0-alpha35.0-beta15.0-beta2 Show 40 moreShow less5.0-beta35.0-beta45.0-beta55.0-beta65.0-beta75.0.15.0.25.0.35.0.45.15.1-beta15.1.15.1.25.1.35.1.45.25.2-alpha15.2-beta15.2.15.2.25.2.35.35.3-alpha15.3.15.45.4-alpha15.4-alpha25.4-beta15.4.15.4.25.4.35.4.45.55.5-alpha15.5.15.5.25.65.6-alpha15.6.15.6.2 |
5.6.3 |
org.apache.httpcomponents.client5:httpclient5Red Hat Lightwell:Maven From an advisory covering 2 CVEs |
before 5.6.0.rhlw-00001, plus listed versions 5.05.0-alpha15.0-alpha25.0-alpha35.0-beta1 Show 40 moreShow less5.0-beta25.0-beta35.0-beta45.0-beta55.0-beta65.0-beta75.0.15.0.25.0.35.0.45.15.1-beta15.1.15.1.25.1.35.1.45.25.2-alpha15.2-beta15.2.15.2.25.2.35.35.3-alpha15.3.15.45.4-alpha15.4-alpha25.4-beta15.4.15.4.25.4.35.4.45.55.5-alpha15.5.15.5.25.65.6-alpha15.6.0 |
5.6.0.rhlw-00001 |
org.apache.httpcomponents.client5:httpclient5Red Hat Lightwell:Maven From an advisory covering 2 CVEs |
before 5.6.2.rhlw-00005, plus listed versions 5.05.0-alpha15.0-alpha25.0-alpha35.0-beta1 Show 41 moreShow less5.0-beta25.0-beta35.0-beta45.0-beta55.0-beta65.0-beta75.0.15.0.25.0.35.0.45.15.1-beta15.1.15.1.25.1.35.1.45.25.2-alpha15.2-beta15.2.15.2.25.2.35.35.3-alpha15.3.15.45.4-alpha15.4-alpha25.4-beta15.4.15.4.25.4.35.4.45.55.5-alpha15.5.15.5.25.65.6-alpha15.6.15.6.2 |
5.6.2.rhlw-00005 |
org.apache.httpcomponents.client5:httpclient5Red Hat Lightwell:Maven From an advisory covering 2 CVEs |
before 5.6.1.rhlw-00026, plus listed versions 5.05.0-alpha15.0-alpha25.0-alpha35.0-beta1 Show 40 moreShow less5.0-beta25.0-beta35.0-beta45.0-beta55.0-beta65.0-beta75.0.15.0.25.0.35.0.45.15.1-beta15.1.15.1.25.1.35.1.45.25.2-alpha15.2-beta15.2.15.2.25.2.35.35.3-alpha15.3.15.45.4-alpha15.4-alpha25.4-beta15.4.15.4.25.4.35.4.45.55.5-alpha15.5.15.5.25.65.6-alpha15.6.1 |
5.6.1.rhlw-00026 |
org.apache.httpcomponents.client5:httpclient5Red Hat Lightwell:Maven |
5.6.1 up to 5.6.1.rhlw-00012 | 5.6.1.rhlw-00012 |
httpcomponents-clientSUSE:Linux Enterprise Module for Development Tools 15 SP7 |
before 4.5.14-150200.3.12.1 | 4.5.14-150200.3.12.1 |
commons-httpclientUbuntu:14.04:LTS |
All versions, plus listed versions 3.1-10.23.1-10.2ubuntu0.14.04.1 |
None known |
httpcomponents-clientUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 4.2.5-24.3.2-14.3.3-14.3.3-1ubuntu0.14.3.3-1ubuntu0.1+esm14.3.3-1ubuntu0.1+esm2 |
None known |
commons-httpclientUbuntu:16.04:LTS |
All versions, plus listed versions 3.1-11ubuntu13.1-12 |
None known |
httpcomponents-clientUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 4.4.1-14.5.1-14.5.1-1ubuntu0.1~esm1 |
None known |
commons-httpclientUbuntu:18.04:LTS |
All versions, plus listed versions 3.1-133.1-143.1-15~18.04 |
None known |
httpcomponents-clientUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 4.5.3-14.5.4-14.5.5-14.5.5-1ubuntu0.1~esm1 |
None known |
commons-httpclientUbuntu:20.04:LTS |
All versions, plus listed versions 3.1-15 |
None known |
httpcomponents-clientUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 4.5.9-14.5.10-24.5.11-14.5.11-1ubuntu0.1~esm1 |
None known |
commons-httpclientUbuntu:22.04:LTS |
All versions, plus listed versions 3.1-16 |
None known |
httpcomponents-clientUbuntu:22.04:LTS |
All versions, plus listed versions 4.5.13-24.5.13-3 |
None known |
commons-httpclientUbuntu:24.04:LTS |
All versions, plus listed versions 3.1-16 |
None known |
httpcomponents-clientUbuntu:24.04:LTS |
All versions, plus listed versions 4.5.14-1 |
None known |
commons-httpclientUbuntu:26.10 |
All versions, plus listed versions 3.1-16build1 |
None known |
httpcomponents-clientUbuntu:26.10 |
All versions, plus listed versions 4.5.14-1build1 |
None known |
commons-httpclientUbuntu:26.04:LTS |
All versions, plus listed versions 3.1-163.1-16build1 |
None known |
httpcomponents-clientUbuntu:26.04:LTS |
All versions, plus listed versions 4.5.14-14.5.14-1build1 |
None known |
httpcomponents-clientopenSUSE:Tumbleweed |
before 4.5.14-2.1 | 4.5.14-2.1 |
httpcomponents-clientopenSUSE:Leap 16.0 |
before 4.5.14-160000.4.1 | 4.5.14-160000.4.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases | OSV | |
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-64607 is a medium vulnerability (CVSS 5.3) in Apache Httpclient, published July 31, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.46%, the 40th percentile. Fixed in org.apache.httpcomponents.client5:httpclient5 5.6.3.
References
lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q
openwall.com/lists/oss-security/2026/08/13/5
nvd.nist.gov/vuln/detail/CVE-2026-64607
github.com/apache/httpcomponents-client/commit/55733f4121f7ba26ddf04fe12739d9c15962cb94
Show 31 moreShow less
repo.maven.apache.org/maven2
security-tracker.debian.org/tracker/CVE-2026-64607
security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40542.json
access.redhat.com/errata/RHSA-2026:60239
suse.com/support/update/announcement/2026/suse-su-20264028-1
bugzilla.suse.com/1273163
ubuntu.com/security/CVE-2026-64607
cve.org/CVERecord?id=CVE-2026-64607