Skip to main content

Apache HttpComponents Client CVE-2026-64607

| EUVDEUVD-2026-51519 MEDIUM
Missing Release of Resource after Effective Lifetime (CWE-772)
2026-07-31 apache GHSA-hjcp-jmpx-g3qm
Information Disclosure Apache Apache Httpcomponents Client
5.3
CVSS 3.1 · Vendor: apache
Share

Severity by source

Vendor (apache) PRIMARY
5.3 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
vuln.today AI
5.3 MEDIUM

Remotely triggered via a single malformed response header (AV:N/AC:L/PR:N/UI:N); impact is a bounded connection-pool leak affecting only availability, so C:N/I:N and A:L rather than A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low

Lifecycle Timeline

3
CVSS changed
Jul 31, 2026 - 17:22 NVD
5.3 (MEDIUM)
Analysis Generated
Jul 31, 2026 - 10:51 vuln.today
CVE Published
Jul 31, 2026 - 10:12 cve.org
HIGH

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 6 maven packages depend on org.apache.httpcomponents.client5:httpclient5 (6 direct, 0 indirect)

Ecosystem-wide dependent count for version 5.0-alpha1.

DescriptionCVE.org

HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. Please note this defect does not affect HttpClient based on the async i/o model.

This issue affects Apache HttpComponents Client: from 5.0-alpha1 through 5.6.2.

AnalysisAI

Denial of service in Apache HttpComponents Client (versions 5.0-alpha1 through 5.6.2) arises when the classic/blocking I/O HttpClient fails to release the underlying connection back to the pool after receiving a response carrying an invalid or unsupported Content-Encoding header. An attacker who controls or can influence the server a client talks to can repeatedly return such headers to leak connections until the pool is exhausted, halting further outbound HTTP requests from the affected Java application. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Induce client to reach attacker-influenced server
Delivery
Return response with invalid Content-Encoding header
Exploit
Classic HttpClient fails to release connection
Execution
Repeat requests to leak pooled connections
Impact
Connection pool exhausted, outbound requests hang (DoS)
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Requires the application to use the classic (blocking) I/O HttpClient - the async I/O HttpClient is explicitly not vulnerable - on a version between 5.0-alpha1 and 5.6.2, and requires the client to receive HTTP responses containing an invalid or unsupported Content-Encoding header value, which means the attacker must control or influence a server the client connects to (malicious upstream, MITM, or attacker-reachable/SSRF target). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment No CVSS vector, EPSS score, KEV entry, or POC was provided, so severity must be inferred from the description and CWE-772. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario A Java service using the classic HttpComponents Client to call an external API is pointed (via configuration, SSRF, or a compromised/malicious upstream) at a server the attacker controls. The server answers each request with a response bearing a bogus Content-Encoding value; every such response leaks a pooled connection, and after enough requests the connection manager is exhausted and the service can no longer make outbound HTTP calls, causing a denial of service. …
Remediation Upgrade Apache HttpComponents Client to the fixed release above 5.6.2 as directed by the Apache advisory at https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q; a released patched version could not be independently confirmed from the provided data, so consult that advisory for the exact fix version rather than relying on an assumed number. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify all Java applications using Apache HttpComponents Client versions 5.0-alpha1 through 5.6.2 and assess which systems make outbound HTTP requests to external or partially-trusted servers. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Apache Httpcomponents Client

View all
CVE-2026-71290 CRITICAL
9.1 Aug 11

Server-impersonation via broken TLS hostname verification affects Apache HttpComponents Client 5.4 through 5.6.3 when ap

Same weakness CWE-772 – Missing Release of Resource after Effective Lifetime

View all
CVE-2017-14495 HIGH POC
7.5
CVE-2024-20481 MEDIUM
5.8
CVE-2017-14138 CRITICAL POC
9.8
CVE-2020-12134 CRITICAL POC
9.8
CVE-2018-19760 HIGH POC
8.8
CVE-2017-13748 HIGH POC
7.5
CVE-2017-15268 HIGH POC
7.5
CVE-2017-11655 HIGH POC
7.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Development Tools 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Server 16.0 Affected

Share

CVE-2026-64607 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy