CVE-2026-64607: Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-31 · updated 2026-10-23
Weakness: CWE-772

Description

HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-Encoding` header value in the response message. Please note this defect does not affect HttpClient based on the async i/o model. This issue affects Apache HttpComponents Client: from 5.0-alpha1 through 5.6.2.

Affected products

Apache Software Foundation Apache HttpClient: from 5.0.0 before 5.6.3 — fixed in 5.6.3

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache HttpClient 5.6.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-64607 or the next vulnerability affects your stack