Skip to main content

Apache HttpComponents Client CVE-2026-64607

| EUVDEUVD-2026-51519 MEDIUM
Missing Release of Resource after Effective Lifetime (CWE-772)
2026-07-31 apache GHSA-hjcp-jmpx-g3qm
Apache Information Disclosure Red Hat Apache Httpcomponents Client Apache Software Foundation
5.3
CVSS 3.1 · Vendor: apache
Share

Severity by source

Vendor (apache) PRIMARY
5.3 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
vuln.today AI
5.3 MEDIUM

Remotely triggered via a single malformed response header (AV:N/AC:L/PR:N/UI:N); impact is a bounded connection-pool leak affecting only availability, so C:N/I:N and A:L rather than A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
7.5 HIGH
qualitative

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low

Lifecycle Timeline

3
CVSS changed
Jul 31, 2026 - 17:22 NVD
5.3 (MEDIUM)
Analysis Generated
Jul 31, 2026 - 10:51 vuln.today
CVE Published
Jul 31, 2026 - 10:12 cve.org
HIGH

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 6 maven packages depend on org.apache.httpcomponents.client5:httpclient5 (6 direct, 0 indirect)

Ecosystem-wide dependent count for version 5.0-alpha1.

DescriptionCVE.org

HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. Please note this defect does not affect HttpClient based on the async i/o model.

This issue affects Apache HttpComponents Client: from 5.0-alpha1 through 5.6.2.

AnalysisAI

Denial of service in Apache HttpComponents Client (versions 5.0-alpha1 through 5.6.2) arises when the classic/blocking I/O HttpClient fails to release the underlying connection back to the pool after receiving a response carrying an invalid or unsupported Content-Encoding header. An attacker who controls or can influence the server a client talks to can repeatedly return such headers to leak connections until the pool is exhausted, halting further outbound HTTP requests from the affected Java application. The async I/O HttpClient is explicitly unaffected; there is no public exploit identified at time of analysis and no CVSS or EPSS data was supplied.

Technical ContextAI

Apache HttpComponents Client is one of the most widely embedded HTTP client libraries in the Java ecosystem, used directly and transitively by countless frameworks, SDKs, and enterprise services. The library exposes two execution models: a classic (synchronous, blocking I/O) client and an async (non-blocking, reactor-based) client - only the classic model is affected. Connections are borrowed from and returned to a PoolingHttpClientConnectionManager. The defect is a CWE-772 (Missing Release of Resource after Effective Lifetime) condition: when response content decoding encounters an unrecognized Content-Encoding value, the error path exits without returning the leased connection to the manager, so each such response permanently consumes a slot from the bounded connection pool.

RemediationAI

Upgrade Apache HttpComponents Client to the fixed release above 5.6.2 as directed by the Apache advisory at https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q; a released patched version could not be independently confirmed from the provided data, so consult that advisory for the exact fix version rather than relying on an assumed number. As interim compensating controls: migrate affected code paths to the async I/O HttpClient, which is not vulnerable (trade-off: non-trivial API/refactoring effort); restrict outbound HTTP calls to trusted, known-good endpoints and apply strict egress/allowlist controls so an attacker cannot supply malicious responses (trade-off: breaks integrations with dynamic third parties); and add pool-health monitoring plus aggressive connection eviction/timeouts and pool-exhaustion alerting so a leak degrades gracefully instead of silently hanging the application (trade-off: mitigates symptoms, does not remove the leak).

More in Apache Httpcomponents Client

View all
CVE-2026-71290 CRITICAL
9.1 Aug 11

Server-impersonation via broken TLS hostname verification affects Apache HttpComponents Client 5.4 through 5.6.3 when ap

Same weakness CWE-772 – Missing Release of Resource after Effective Lifetime

View all
CVE-2017-14495 HIGH POC
7.5
CVE-2024-20481 MEDIUM
5.8
CVE-2017-14138 CRITICAL POC
9.8
CVE-2020-12134 CRITICAL POC
9.8
CVE-2018-19760 HIGH POC
8.8
CVE-2017-13748 HIGH POC
7.5
CVE-2017-15268 HIGH POC
7.5
CVE-2017-11655 HIGH POC
7.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Development Tools 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Server 16.0 Affected

Share

CVE-2026-64607 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy