CVE-2026-64607 Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS
Attackers can cause connection pool exhaustion and denial of service by sending responses with invalid Content-Encoding headers to applications using the classic I/O model.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-64607?
CVE-2026-64607 is a medium-severity denial of service vulnerability in Apache HttpComponents Client, published on 31 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-Encoding` header value in the response message. Please note this defect does not affect HttpClient based on the async i/o model.
This issue affects Apache HttpComponents Client: from 5.0-alpha1 through 5.6.2.
Weakness: CWE-772
Which versions are affected by CVE-2026-64607?
2 open source packages ship an affected version, including org.apache.httpcomponents.client5:httpclient5. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.httpcomponents.client5:httpclient5 Maven | From 5.0-alpha1 | 5.6.3 |
org.apache.httpcomponents.client5:httpclient5 Maven | From 5.0-alpha1 | 5.6.3 |
Linux distribution packages (3)
httpcomponents-client SUSE:Linux Enterprise Module for Development Tools 15 SP7 | All versions | 4.5.14-150200.3.12.1 |
httpcomponents-client openSUSE:Leap 16.0 | All versions | 4.5.14-160000.4.1 |
httpcomponents-client openSUSE:Tumbleweed | All versions | 4.5.14-2.1 |
Products include Apache Httpclient.
How do I fix CVE-2026-64607?
Upgrade org.apache.httpcomponents.client5:httpclient5 to 5.6.3 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-64607 being exploited?
There is no known exploitation of CVE-2026-64607 in the wild and no public exploit code.
Other vulnerabilities in Apache HttpComponents Client
- CVE-2013-4366 Hostname verification in Apache HttpClient 4.3 was disabled by default
- CVE-2026-71290 Apache HttpComponents Client: TLS hostname verification silently disabled on the async transport (default config, MITM)
- CVE-2025-27820 Apache HttpComponents: PSL (Public Suffix List) validation bypass
- CVE-2026-40542 Apache HttpClient accepts SCRAM-SHA-256 authentication without proper mutual authentication verification
- CVE-2012-5783 Improper Certificate Validation in Apache Commons HttpClient
Sources
Also known as CLEANSTART-2026-EK15836, CLEANSTART-2026-FO83563, CLEANSTART-2026-HB58573, CLEANSTART-2026-LH05062, CLEANSTART-2026-RC74250, CLEANSTART-2026-SO94492 and 49 more.