Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS
HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-Encoding` header value in the response message. Please note this defect does not affect HttpClient based on the async i/o model. This issue affects Apache HttpComponents Client: from 5.0-alpha1 through 5.6.2.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-64607US | — | — | ||
HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-En… | ||||
02
references
External citations — patches, advisories, analysis.
- http://www.openwall.com/lists/oss-security/2026/08/13/5WEB
- https://github.com/apache/httpcomponents-clientPACKAGE
- https://github.com/apache/httpcomponents-client/commit/55733f4121f7ba26ddf04fe12739d9c15962cb94WEB
- https://github.com/apache/httpcomponents-client/commit/ebac9512f555c4a355cad3f59ef2db69b597cc97WEB
- https://github.com/apache/httpcomponents-client/releases/tag/rel/v5.6.3WEB
- https://github.com/apache/httpcomponents-client/releases/tag/rel/v5.7-alpha1WEB
- https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511qWEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-64607ADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan