{"id":"CVE-2026-64607","aliases":["CLSA-2026-1786537061","CLSA-2026-1789373020","CLSA-2026-1789474443","CLSA-2026-1792743499","CLSA-2026-1792743815","CLSA-2026-1792744283","CLSA-2026-1792745046","DEBIAN-CVE-2026-64607","EUVD-2026-51519","GHSA-hjcp-jmpx-g3qm","GHSA-v468-qcjx-r72w","RHLW-2026-2a7b95611000d6b5","RHLW-2026-32de0f514c232ff5","RHLW-2026-639f255bd180ae78","RHLW-2026-8118b2499151de91","SUSE-SU-2026:4028-1","UBUNTU-CVE-2026-64607","openSUSE-SU-2026:11647-1","openSUSE-SU-2026:21894-1"],"status":"published","title":"Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS","description":"HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-Encoding` header value in the response message. Please note this defect does not affect HttpClient based on the async i/o model.\n\nThis issue affects Apache HttpComponents Client: from 5.0-alpha1 through 5.6.2.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00464,"percentile":0.40476,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-772"],"published":"2026-07-31T10:12:18Z","modified":"2026-11-06T19:30:03Z","fixes":[{"ecosystem":"Maven","package":"org.apache.httpcomponents.client5:httpclient5","fixed_in":["5.6.3"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:Maven","package":"org.apache.httpcomponents.client5:httpclient5","fixed_in":["5.5.2-tuxcare.1","5.3.1-tuxcare.1","5.0.3-tuxcare.1","5.1.4-tuxcare.1","5.2.3-tuxcare.1","5.1.3-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Red Hat Lightwell:Maven","package":"org.apache.httpcomponents.client5:httpclient5","fixed_in":["5.6.1.rhlw-00012"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"httpcomponents-client","fixed_in":["4.5.14-150200.3.12.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"httpcomponents-client","fixed_in":["4.5.14-2.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"httpcomponents-client","fixed_in":["4.5.14-160000.4.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.httpcomponents.client5:httpclient5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0-alpha1"},{"fixed":"5.6.3"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.httpcomponents.client5:httpclient5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.5.2"},{"fixed":"5.5.2-tuxcare.1"}]}],"versions":["5.5.2"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.httpcomponents.client5:httpclient5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.1"},{"fixed":"5.3.1-tuxcare.1"}]}],"versions":["5.3.1"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.httpcomponents.client5:httpclient5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.3"},{"fixed":"5.0.3-tuxcare.1"}]}],"versions":["5.0.3"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.httpcomponents.client5:httpclient5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.4"},{"fixed":"5.1.4-tuxcare.1"}]}],"versions":["5.1.4"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.httpcomponents.client5:httpclient5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.3"},{"fixed":"5.2.3-tuxcare.1"}]}],"versions":["5.2.3"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.httpcomponents.client5:httpclient5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.3"},{"fixed":"5.1.3-tuxcare.1"}]}],"versions":["5.1.3"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.httpcomponents.client5:httpclient5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.4.4"},{"fixed":"5.4.4-tuxcare.1"}]}],"versions":["5.4.4"],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1-16"]},{"source":"osv","ecosystem":"Debian:13","package":"commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1-16"]},{"source":"osv","ecosystem":"Debian:14","package":"commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1-16"]},{"source":"osv","ecosystem":"Debian:12","package":"httpcomponents-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.5.14-1"]},{"source":"osv","ecosystem":"Debian:13","package":"httpcomponents-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.5.14-1"]},{"source":"osv","ecosystem":"Debian:14","package":"httpcomponents-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.5.14-1"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.httpcomponents.client5:httpclient5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0-alpha1"},{"fixed":"5.6.3"}]}],"versions":["5.0","5.0-alpha1","5.0-alpha2","5.0-alpha3","5.0-beta1","5.0-beta2","5.0-beta3","5.0-beta4","5.0-beta5","5.0-beta6","5.0-beta7","5.0.1","5.0.2","5.0.3","5.0.4","5.1","5.1-beta1","5.1.1","5.1.2","5.1.3","5.1.4","5.2","5.2-alpha1","5.2-beta1","5.2.1","5.2.2","5.2.3","5.3","5.3-alpha1","5.3.1","5.4","5.4-alpha1","5.4-alpha2","5.4-beta1","5.4.1","5.4.2","5.4.3","5.4.4","5.5","5.5-alpha1","5.5.1","5.5.2","5.6","5.6-alpha1","5.6.1","5.6.2"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.apache.httpcomponents.client5:httpclient5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.0.rhlw-00001"}]}],"versions":["5.0","5.0-alpha1","5.0-alpha2","5.0-alpha3","5.0-beta1","5.0-beta2","5.0-beta3","5.0-beta4","5.0-beta5","5.0-beta6","5.0-beta7","5.0.1","5.0.2","5.0.3","5.0.4","5.1","5.1-beta1","5.1.1","5.1.2","5.1.3","5.1.4","5.2","5.2-alpha1","5.2-beta1","5.2.1","5.2.2","5.2.3","5.3","5.3-alpha1","5.3.1","5.4","5.4-alpha1","5.4-alpha2","5.4-beta1","5.4.1","5.4.2","5.4.3","5.4.4","5.5","5.5-alpha1","5.5.1","5.5.2","5.6","5.6-alpha1","5.6.0"],"bundled":2},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.apache.httpcomponents.client5:httpclient5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.2.rhlw-00005"}]}],"versions":["5.0","5.0-alpha1","5.0-alpha2","5.0-alpha3","5.0-beta1","5.0-beta2","5.0-beta3","5.0-beta4","5.0-beta5","5.0-beta6","5.0-beta7","5.0.1","5.0.2","5.0.3","5.0.4","5.1","5.1-beta1","5.1.1","5.1.2","5.1.3","5.1.4","5.2","5.2-alpha1","5.2-beta1","5.2.1","5.2.2","5.2.3","5.3","5.3-alpha1","5.3.1","5.4","5.4-alpha1","5.4-alpha2","5.4-beta1","5.4.1","5.4.2","5.4.3","5.4.4","5.5","5.5-alpha1","5.5.1","5.5.2","5.6","5.6-alpha1","5.6.1","5.6.2"],"bundled":2},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.apache.httpcomponents.client5:httpclient5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.1.rhlw-00026"}]}],"versions":["5.0","5.0-alpha1","5.0-alpha2","5.0-alpha3","5.0-beta1","5.0-beta2","5.0-beta3","5.0-beta4","5.0-beta5","5.0-beta6","5.0-beta7","5.0.1","5.0.2","5.0.3","5.0.4","5.1","5.1-beta1","5.1.1","5.1.2","5.1.3","5.1.4","5.2","5.2-alpha1","5.2-beta1","5.2.1","5.2.2","5.2.3","5.3","5.3-alpha1","5.3.1","5.4","5.4-alpha1","5.4-alpha2","5.4-beta1","5.4.1","5.4.2","5.4.3","5.4.4","5.5","5.5-alpha1","5.5.1","5.5.2","5.6","5.6-alpha1","5.6.1"],"bundled":2},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.apache.httpcomponents.client5:httpclient5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.1"},{"fixed":"5.6.1.rhlw-00012"}]}],"versions":["5.6.1"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"httpcomponents-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.14-150200.3.12.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1-10.2","3.1-10.2ubuntu0.14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"httpcomponents-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.2.5-2","4.3.2-1","4.3.3-1","4.3.3-1ubuntu0.1","4.3.3-1ubuntu0.1+esm1","4.3.3-1ubuntu0.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1-11ubuntu1","3.1-12"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"httpcomponents-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.1-1","4.5.1-1","4.5.1-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1-13","3.1-14","3.1-15~18.04"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"httpcomponents-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.5.3-1","4.5.4-1","4.5.5-1","4.5.5-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1-15"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"httpcomponents-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.5.9-1","4.5.10-2","4.5.11-1","4.5.11-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1-16"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"httpcomponents-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.5.13-2","4.5.13-3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1-16"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"httpcomponents-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.5.14-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1-16build1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"httpcomponents-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.5.14-1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1-16","3.1-16build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"httpcomponents-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.5.14-1","4.5.14-1build1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"httpcomponents-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.14-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"httpcomponents-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.14-160000.4.1"}]}]}],"products":[{"vendor":"apache","product":"httpclient"},{"vendor":"apache software foundation","product":"apache httpcomponents client"}],"references":[{"url":"https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q","tags":["vendor-advisory","Mailing List","Release Notes","advisory","web","report"]},{"url":"http://www.openwall.com/lists/oss-security/2026/08/13/5","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64607","tags":["advisory"]},{"url":"https://github.com/apache/httpcomponents-client/commit/55733f4121f7ba26ddf04fe12739d9c15962cb94","tags":["web"]},{"url":"https://github.com/apache/httpcomponents-client/commit/ebac9512f555c4a355cad3f59ef2db69b597cc97","tags":["web"]},{"url":"https://github.com/apache/httpcomponents-client/releases/tag/rel/v5.6.3","tags":["web"]},{"url":"https://github.com/apache/httpcomponents-client/releases/tag/rel/v5.7-alpha1","tags":["web"]},{"url":"https://github.com/advisories/GHSA-hjcp-jmpx-g3qm","tags":["advisory"]},{"url":"https://repo.maven.apache.org/maven2/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64607.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-64607","tags":["advisory"]},{"url":"https://github.com/apache/httpcomponents-client","tags":["package"]},{"url":"https://repo.maven.apache.org/maven2","tags":["web"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40542.json","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60239","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60246","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60247","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60248","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60249","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60250","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60251","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60252","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60254","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60256","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60259","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-40542","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40542.json","tags":["advisory"]},{"url":"https://lists.apache.org/thread/tfmgv86xr0z1y096vs3z0y315t1v3o97","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40542","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-v468-qcjx-r72w","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71290.json","tags":["advisory"]},{"url":"https://lists.apache.org/thread/bhf7g2zwpom2ohvwjjjlonc93br2s8vq","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71290","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264028-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1273163","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64607","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-64607","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-64607","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-64607","title":"Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS","description":"HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-Encoding` header value in the response message. Please note this defect does not affect HttpClient based on the async i/o model.\n\nThis issue affects Apache HttpComponents Client: from 5.0-alpha1 through 5.6.2.","status":"published","published":"2026-07-31T10:12:18.035Z","modified":"2026-08-13T16:18:20.395Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"adp"}],"cwes":["CWE-772"],"updated_at":"2026-11-02T14:19:57.818032Z"}],"euvd":[{"id":"EUVD-2026-51519","description":"HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-Encoding` header value in the response message. Please note this defect does not affect HttpClient based on the async i/o model.\n\nThis issue affects Apache HttpComponents Client: from 5.0-alpha1 through 5.6.2.","status":"published","published":"2026-07-31T10:12:18Z","modified":"2026-08-13T16:18:20Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T18:01:55.61982Z"}],"ghsa":[{"id":"GHSA-hjcp-jmpx-g3qm","title":"Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS","description":"HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-Encoding` header value in the response message. Please note this defect does not affect HttpClient based on the async i/o model.\n\nThis issue affects Apache HttpComponents Client: from 5.0-alpha1 through 5.6.2.","status":"published","published":"2026-07-31T12:30:30Z","modified":"2026-08-13T18:40:19Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-772"],"updated_at":"2026-11-02T14:41:00.097339Z"}],"nvd":[{"id":"CVE-2026-64607","description":"HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-Encoding` header value in the response message. Please note this defect does not affect HttpClient based on the async i/o model.\n\nThis issue affects Apache HttpComponents Client: from 5.0-alpha1 through 5.6.2.","status":"published","published":"2026-07-31T11:17:11.71Z","modified":"2026-10-23T23:10:00.157Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-772"],"updated_at":"2026-11-02T14:12:34.290716Z"}],"osv":[{"id":"CVE-2026-64607","title":"Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS","description":"HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-Encoding` header value in the response message. Please note this defect does not affect HttpClient based on the async i/o model.\n\nThis issue affects Apache HttpComponents Client: from 5.0-alpha1 through 5.6.2.","status":"published","published":"2026-07-31T10:12:18.035Z","modified":"2026-10-28T02:30:55.407091171Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-772"],"updated_at":"2026-11-02T15:45:14.096824Z"},{"id":"DEBIAN-CVE-2026-64607","description":"HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-Encoding` header value in the response message. Please note this defect does not affect HttpClient based on the async i/o model.  This issue affects Apache HttpComponents Client: from 5.0-alpha1 through 5.6.2.","status":"published","published":"2026-07-31T11:17:11.71Z","modified":"2026-10-24T09:47:30.141487774Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:58.699079Z"},{"id":"GHSA-hjcp-jmpx-g3qm","title":"Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS","description":"HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-Encoding` header value in the response message. Please note this defect does not affect HttpClient based on the async i/o model.\n\nThis issue affects Apache HttpComponents Client: from 5.0-alpha1 through 5.6.2.","status":"published","published":"2026-07-31T12:30:30Z","modified":"2026-09-10T03:50:12.358752934Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-772"],"updated_at":"2026-11-02T15:46:49.28217Z"},{"id":"RHLW-2026-2a7b95611000d6b5","title":"Lightwell Security Advisory: httpclient5 5.6.0.rhlw-00001","description":"Red Hat Lightwell has released org.apache.httpcomponents.client5:httpclient5 5.6.0.rhlw-00001 with backported fixes for CVE-2026-40542 and CVE-2026-64607.\n\nCVE-2026-40542: Apache HttpClient: SCRAM-SHA-256 mutual authentication bypass may cause the client to accept authentication without proper mutual authentication verification\n\nCVE-2026-64607: Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS\n\nThis patched artifact is a drop-in replacement for org.apache.httpcomponents.client5:httpclient5 5.6.0 from Maven Central.","status":"published","published":"2026-10-12T16:58:44Z","modified":"2026-10-27T04:13:01.828147266Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHLW-2026-32de0f514c232ff5","title":"Lightwell Security Advisory: httpclient5 5.6.2.rhlw-00005","description":"Red Hat Lightwell has released org.apache.httpcomponents.client5:httpclient5 5.6.2.rhlw-00005 with backported fixes for CVE-2026-64607 and CVE-2026-71290.\n\nCVE-2026-64607: Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS\n\nCVE-2026-71290: Apache HttpComponents Client: TLS hostname verification silently disabled on the async transport (default config, MITM)\n\nThis patched artifact is a drop-in replacement for org.apache.httpcomponents.client5:httpclient5 5.6.2 from Maven Central.","status":"published","published":"2026-10-08T00:00:00Z","modified":"2026-10-27T04:00:05.538251239Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHLW-2026-639f255bd180ae78","title":"Lightwell Security Advisory: httpclient5 5.6.1.rhlw-00026","description":"Red Hat Lightwell has released org.apache.httpcomponents.client5:httpclient5 5.6.1.rhlw-00026 with backported fixes for CVE-2026-64607 and CVE-2026-71290.\n\nCVE-2026-64607: Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS\n\nCVE-2026-71290: Apache HttpComponents Client: TLS hostname verification silently disabled on the async transport (default config, MITM)\n\nThis patched artifact is a drop-in replacement for org.apache.httpcomponents.client5:httpclient5 5.6.1 from Maven Central.","status":"published","published":"2026-11-03T11:05:42Z","modified":"2026-11-06T19:30:03.81897266Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-06T19:35:45.633414Z"},{"id":"RHLW-2026-8118b2499151de91","title":"Lightwell Security Advisory: httpclient5 5.6.1.rhlw-00012","description":"Red Hat Lightwell has released org.apache.httpcomponents.client5:httpclient5 5.6.1.rhlw-00012 with a backported security fix.\n\nCVE-2026-64607: Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS\n\nThis patched artifact is a drop-in replacement for org.apache.httpcomponents.client5:httpclient5 5.6.1 from Maven Central.","status":"published","published":"2026-10-12T16:58:46Z","modified":"2026-10-29T14:30:05.398497644Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"UBUNTU-CVE-2026-64607","description":"HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-Encoding` header value in the response message. Please note this defect does not affect HttpClient based on the async i/o model. This issue affects Apache HttpComponents Client: from 5.0-alpha1 through 5.6.2.","status":"published","published":"2026-07-31T11:17:00Z","modified":"2026-10-17T13:00:33.939286919Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T16:56:53.710209Z"},{"id":"CLSA-2026-1786537061","title":"TuxCare security update for org.apache.httpcomponents.client5:httpclient5 (1 CVE)","description":"TuxCare rebuilt org.apache.httpcomponents.client5:httpclient5 to address 1 CVE. Fixed in 5.5.2-tuxcare.1.","status":"published","published":"2026-08-12T12:17:41Z","modified":"2026-11-02T19:45:53.386865581Z","updated_at":"2026-11-02T20:30:00.884471Z"},{"id":"CLSA-2026-1789373020","title":"TuxCare security update for org.apache.httpcomponents.client5:httpclient5 (1 CVE)","description":"TuxCare rebuilt org.apache.httpcomponents.client5:httpclient5 to address 1 CVE. Fixed in 5.3.1-tuxcare.1.","status":"published","published":"2026-09-14T08:03:40Z","modified":"2026-11-02T19:46:14.364350806Z","updated_at":"2026-11-02T20:29:33.792105Z"},{"id":"CLSA-2026-1789474443","title":"TuxCare security update for org.apache.httpcomponents.client5:httpclient5 (1 CVE)","description":"TuxCare rebuilt org.apache.httpcomponents.client5:httpclient5 to address 1 CVE. Fixed in 5.0.3-tuxcare.1.","status":"published","published":"2026-09-15T12:14:03Z","modified":"2026-11-02T19:46:15.980090064Z","updated_at":"2026-11-02T20:29:33.792105Z"},{"id":"CLSA-2026-1792743499","title":"TuxCare security update for org.apache.httpcomponents.client5:httpclient5 (1 CVE)","description":"TuxCare rebuilt org.apache.httpcomponents.client5:httpclient5 to address 1 CVE. Fixed in 5.1.4-tuxcare.1.","status":"published","published":"2026-10-23T08:18:19Z","modified":"2026-11-02T19:46:31.324663398Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1792743815","title":"TuxCare security update for org.apache.httpcomponents.client5:httpclient5 (1 CVE)","description":"TuxCare rebuilt org.apache.httpcomponents.client5:httpclient5 to address 1 CVE. Fixed in 5.2.3-tuxcare.1.","status":"published","published":"2026-10-23T08:23:35Z","modified":"2026-11-02T19:46:31.275316563Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1792744283","title":"TuxCare security update for org.apache.httpcomponents.client5:httpclient5 (1 CVE)","description":"TuxCare rebuilt org.apache.httpcomponents.client5:httpclient5 to address 1 CVE. Fixed in 5.1.3-tuxcare.1.","status":"published","published":"2026-10-23T08:31:23Z","modified":"2026-11-02T19:46:31.231343376Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1792745046","title":"TuxCare security update for org.apache.httpcomponents.client5:httpclient5 (2 CVEs)","description":"TuxCare rebuilt org.apache.httpcomponents.client5:httpclient5 to address 2 CVEs. Fixed in 5.4.4-tuxcare.1.","status":"published","published":"2026-10-23T08:44:06Z","modified":"2026-11-02T19:46:31.00692407Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"openSUSE-SU-2026:11647-1","title":"httpcomponents-client-4.5.14-2.1 on GA media","description":"These are all security issues fixed in the httpcomponents-client-4.5.14-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-30T00:00:00Z","modified":"2026-08-31T10:00:04.870509102Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:21894-1","title":"Security update for httpcomponents-client","description":"This update for httpcomponents-client fixes the following issue:\n\n- CVE-2026-64607: improper release of underlying connection back to connection manager when an invalid or unsupported\n  `Content-Encoding` header value in a response message (bsc#1273163).\n","status":"published","published":"2026-09-20T18:38:32Z","modified":"2026-09-25T18:23:11.534291387Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:4028-1","title":"Security update for httpcomponents-client","description":"This update for httpcomponents-client fixes the following issue:\n\n- CVE-2026-64607: improper release of underlying connection back to connection manager when an invalid or unsupported\n  `Content-Encoding` header value in a response message (bsc#1273163).\n","status":"published","published":"2026-09-07T07:45:16Z","modified":"2026-09-13T18:23:16.455417943Z","updated_at":"2026-11-02T15:54:05.392906Z"}]}}