GHSA-hjcp-jmpx-g3qm: Medium severity maven/org.apache.httpcomponents.client5:httpclient5 vulnerability

Q: Which HttpClient deployments are affected?

Only HttpClient instances using the classic I/O model are affected. HttpClient instances using the async I/O model are not affected.

Q: What condition triggers the connection-release failure?

The failure occurs when the classic I/O HttpClient receives a response containing an invalid or unsupported Content-Encoding header value. In that case, the underlying connection may not be returned correctly to the connection manager.

Q: What can be done if upgrading is not immediately possible?

Where feasible, use the async I/O HttpClient model, which is not affected by this defect. The affected version range is 5.0-alpha1 through 5.6.2.

Published Jul 31, 2026

Updated

HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. Please note this defect does not affect HttpClient based on the async i/o model.

This issue affects Apache HttpComponents Client: from 5.0-alpha1 through 5.6.2.

Affected Software

1 affected componentFixes available

maven/org.apache.httpcomponents.client5:httpclient5>=5.0-alpha1<5.6.3

5.6.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade maven/org.apache.httpcomponents.client5:httpclient5 to a version that resolves this vulnerability.
Fixed in 5.6.3

Event History

Jul 31, 2026

Advisory Published

via GitHub·12:30 PM

Data Sourced

via GitHub·12:30 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Which HttpClient deployments are affected?

Only HttpClient instances using the classic I/O model are affected. HttpClient instances using the async I/O model are not affected.

What condition triggers the connection-release failure?

The failure occurs when the classic I/O HttpClient receives a response containing an invalid or unsupported Content-Encoding header value. In that case, the underlying connection may not be returned correctly to the connection manager.

What can be done if upgrading is not immediately possible?

Where feasible, use the async I/O HttpClient model, which is not affected by this defect. The affected version range is 5.0-alpha1 through 5.6.2.

GHSA-hjcp-jmpx-g3qm: Medium severity maven/org.apache.httpcomponents.client5:httpclient5 vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which HttpClient deployments are affected?

What condition triggers the connection-release failure?

What can be done if upgrading is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Which HttpClient deployments are affected?

What condition triggers the connection-release failure?

What can be done if upgrading is not immediately possible?