CVE-2026-64607

MediumCVSS 5.3

Published: 31/07/2026(UTC)Updated: 13/08/2026(UTC)Translated: 31/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.33%

26th percentile - higher than 26% of all known CVEs

Summary

In Apache HttpComponents Client versions 5.0-alpha1 through 5.6.2, the classic I/O-based HTTP client fails to properly release connections back to the connection manager when encountering an invalid or unsupported Content-Encoding header value. This defect does not affect the async I/O model.

Risk Assessment

The risk is connection leakage, potentially leading to connection pool exhaustion and denial of service (DoS) for applications using this HTTP client.

Recommendation

Upgrade Apache HttpComponents Client to version 5.6.3 or later, which includes the fix.

Other vulnerabilities in Apache HttpComponents Client

CVE-2026-71290Critical
Improper TLS hostname verification in Apache HttpComponents Client 5.4 or newer. The HostnameVerificationPolicy#BUILTIN setting has no effect when used with the async version of HttpClient. An attacker who can intercept and modify traffic can impersonate the server by presenting a valid certificate for a different domain. The classic version is not affected. Upgrade to at least 5.6.4 is recommended.

Original NVD description (English source)

HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-Encoding` header value in the response message. Please note this defect does not affect HttpClient based on the async i/o model. This issue affects Apache HttpComponents Client: from 5.0-alpha1 through 5.6.2.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS