CVE-2026-64607: Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS
(updated )
HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. Please note this defect does not affect HttpClient based on the async i/o model.
This issue affects Apache HttpComponents Client: from 5.0-alpha1 through 5.6.2.
References
- github.com/advisories/GHSA-hjcp-jmpx-g3qm
- github.com/apache/httpcomponents-client/commit/55733f4121f7ba26ddf04fe12739d9c15962cb94
- github.com/apache/httpcomponents-client/commit/ebac9512f555c4a355cad3f59ef2db69b597cc97
- github.com/apache/httpcomponents-client/releases/tag/rel/v5.6.3
- github.com/apache/httpcomponents-client/releases/tag/rel/v5.7-alpha1
- lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q
- nvd.nist.gov/vuln/detail/CVE-2026-64607
Code Behaviors & Features
Detect and mitigate CVE-2026-64607 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →