CVE-2026-64607

Modified Modified - Updated After Analysis

Apache HttpClient Connection Leak via Invalid Content-Encoding

Publication date: 2026-07-31

Last updated on: 2026-08-13

Assigner: Apache Software Foundation

Description

HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-Encoding` header value in the response message. Please note this defect does not affect HttpClient based on the async i/o model. This issue affects Apache HttpComponents Client: from 5.0-alpha1 through 5.6.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-31

Last Modified

2026-08-13

Generated

2026-08-20

AI Q&A

2026-07-31

EPSS Evaluated

2026-08-19

NVD

CVE-2026-64607

EUVD

EUVD-2026-51519

Affected Vendors & Products

Vendor	Product	Version / Range
apache	httpclient	From 5.0.0 (inc) to 5.6.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-772	The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.

Attack-Flow Graph

Executive Summary

This vulnerability affects Apache HttpComponents Client versions 5.0-alpha1 through 5.6.2. It occurs when the HttpClient, which uses the classic I/O model, fails to properly release the underlying connection back to the connection manager if the response contains an invalid or unsupported Content-Encoding header value.

Detection Guidance

This vulnerability can be detected by checking the Apache HttpComponents Client version in use. If your system runs versions 5.0-alpha1 through 5.6.2, it is affected. No specific commands are provided for detection beyond version verification.

Impact Analysis

This issue could lead to a resource leak where connections are not properly closed and returned to the pool. This may cause the application to run out of available connections, leading to performance degradation or denial of service.

Compliance Impact

This vulnerability does not directly impact compliance with standards like GDPR or HIPAA as it involves a technical issue with connection management in Apache HttpComponents Client. However, improper handling of connections could potentially lead to resource exhaustion or denial-of-service scenarios, which may indirectly affect system availability and data processing integrity.

Mitigation Strategies

Upgrade Apache HttpComponents Client to a version beyond 5.6.2 to resolve the issue. If using async i/o model, no action is needed as it is not affected.

Hi! I’m here to help you understand CVE-2026-64607. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70