> CVE-2026-64607

« BACK_TO_HOME
PUBLISHED
2026-07-31 11:17
MODIFIED
2026-07-31 11:17
EPSS (Prob. Exploit)
0.46%
Top 59.8%
DATA SOURCES:
NVD 🔗 2026-07-31 CWE MITRE 🔗 2026-11-01 FIRST EPSS 🔗 2026-11-01 GITHUB 🔗 2026-10-29 OSV 🔗 2026-10-26

> DESCRIPTION

HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-Encoding` header value in the response message. Please note this defect does not affect HttpClient based on the async i/o model. This issue affects Apache HttpComponents Client: from 5.0-alpha1 through 5.6.2.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> WEAKNESSES

CWE-772

> CWE DETAILED DESCRIPTIONS

CWE-772: Missing Release of Resource after Effective Lifetime - The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.

> RED HAT SECURITY ADVISORIES

Red Hat Security Advisory: Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.3.SP1)
An update for Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.3.SP1).The purpose of this text-only errata is to inform you about the enhancements that improve yo...
Red Hat Security Advisory: Red Hat Build of Apache Camel 4.18.4 for Spring Boot release.
Red Hat build of Apache Camel 4.18.4 for Spring Boot patch release and security update is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Com...
Red Hat Security Advisory: Red Hat build of Debezium 3.6.3 release
Red Hat build of Debezium connectors in version 3.6.3 are now available for Red Hat Application Foundations.
Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.31.0 Release.
Red Hat OpenShift Dev Spaces 3.31.0 has been released.

> GITHUB SECURITY ADVISORY

GHSA-hjcp-jmpx-g3qm MODERATE

Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS

AFFECTED PACKAGES:
MAVEN / org.apache.httpcomponents.client5:httpclient5
>= 5.0-alpha1, < 5.6.3
Fixed in: 5.6.3

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS

AFFECTED PACKAGES:
Unknown / Unknown
13 versions affected
ALIASES:
GHSA-hjcp-jmpx-g3qm

> HISTORIQUE DES MODIFICATIONS

Première apparition
31/07/2026 11:17
Source: NVD
📊 ENRICHISSEMENT 01/08/2026 06:01
CWE
Champ modifié: Description CWE
Ancienne valeur:
N/A
Nouvelle valeur:
CWE-772: Missing Release of Resource after Effective Lifetime - The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.
Total des modifications: 1 Dernière mise à jour: 3 months ago

> REFERENCES

https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q
« BACK_TO_HOME