RHLW-2026-639f255bd180ae78: Lightwell Security Advisory: httpclient5 5.6.1.rhlw-00026

Q: Which deployments face the highest risk from the TLS issue?

Applications using the async transport are affected because TLS hostname verification can be silently disabled in the default configuration. An attacker positioned to perform a man-in-the-middle attack could exploit this condition.

Q: What conditions are needed for the denial-of-service issue?

The connection-pool exhaustion issue is triggered when content-encoding decoding encounters an error and leaks connections. Environments that use connection pooling can be affected by resulting pool exhaustion.

Q: What should teams use to remediate these issues?

Use Red Hat Lightwell's org.apache.httpcomponents.client5:httpclient5 5.6.1.rhlw-00026 artifact. It includes backported fixes for both CVE-2026-64607 and CVE-2026-71290 and is a drop-in replacement for version 5.6.1 from Maven Central.

Published Nov 3, 2026

Updated

Red Hat Lightwell has released org.apache.httpcomponents.client5:httpclient5 5.6.1.rhlw-00026 with backported fixes for CVE-2026-64607 and CVE-2026-71290.

CVE-2026-64607: Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS

CVE-2026-71290: Apache HttpComponents Client: TLS hostname verification silently disabled on the async transport (default config, MITM)

This patched artifact is a drop-in replacement for org.apache.httpcomponents.client5:httpclient5 5.6.1 from Maven Central.

Affected Software

1 affected componentFixes available

red-hat-lightwell/org.apache.httpcomponents.client5:httpclient5<5.6.1.rhlw-00026

5.6.1.rhlw-00026

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade red-hat-lightwell/org.apache.httpcomponents.client5:httpclient5 to a version that resolves this vulnerability.
Fixed in 5.6.1.rhlw-00026
Upgrade
Upgrade org.apache.httpcomponents.client5:httpclient5 to a version that resolves this vulnerability.
Fixed in 5.6.1.rhlw-00026Patch CVE-2026-64607
Upgrade
Upgrade org.apache.httpcomponents.client5:httpclient5 to a version that resolves this vulnerability.
Fixed in 5.6.1.rhlw-00026Patch CVE-2026-71290

Event History

Nov 3, 2026

Advisory Published

via OSV·11:05 AM

Data Sourced

via OSV·11:05 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

Which deployments face the highest risk from the TLS issue?

Applications using the async transport are affected because TLS hostname verification can be silently disabled in the default configuration. An attacker positioned to perform a man-in-the-middle attack could exploit this condition.

What conditions are needed for the denial-of-service issue?

The connection-pool exhaustion issue is triggered when content-encoding decoding encounters an error and leaks connections. Environments that use connection pooling can be affected by resulting pool exhaustion.

What should teams use to remediate these issues?

Use Red Hat Lightwell's org.apache.httpcomponents.client5:httpclient5 5.6.1.rhlw-00026 artifact. It includes backported fixes for both CVE-2026-64607 and CVE-2026-71290 and is a drop-in replacement for version 5.6.1 from Maven Central.

RHLW-2026-639f255bd180ae78: Lightwell Security Advisory: httpclient5 5.6.1.rhlw-00026

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployments face the highest risk from the TLS issue?

What conditions are needed for the denial-of-service issue?

What should teams use to remediate these issues?

Company

Resources

Contact

Frequently Asked Questions

Which deployments face the highest risk from the TLS issue?

What conditions are needed for the denial-of-service issue?

What should teams use to remediate these issues?