CVE-2026-64607: Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS
HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. Please note this defect does not affect HttpClient based on the async i/o model.
This issue affects Apache HttpComponents Client: from 5.0-alpha1 through 5.6.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache HttpComponents Clientto a version that resolves this vulnerability.Fixed in 5.6.2Patch CVE-2026-64607
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64607?
CVE-2026-64607 has a risk rating of 35.
How do I fix CVE-2026-64607?
To fix CVE-2026-64607, update to the latest version of Apache HttpComponents Client that addresses the connection leak issue.
What systems are affected by CVE-2026-64607?
CVE-2026-64607 affects the Apache HttpComponents Client based on the classic I/O model.
What is the impact of CVE-2026-64607?
CVE-2026-64607 can lead to connection leaks and exhaustion of the connection pool, resulting in a denial of service (DoS) condition.
Does CVE-2026-64607 affect asynchronous I/O models?
No, CVE-2026-64607 does not affect the HttpClient based on the asynchronous I/O model.