< Back

CVE-2026-64607

Updated on 31 Jul 2026

Severity

5.3 Medium severity

Details

CVSS score
5.3
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE ID
Links
NISTCIRCLRHELUbuntu

Overview

About vulnerability

HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. Please note this defect does not affect HttpClient based on the async i/o model.

This issue affects Apache HttpComponents Client: from 5.0-alpha1 through 5.6.2.

Details

Affected product:
Apache CXF , Apache Solr , Hazelcast , OpenSearch , Spring , Wildfly , aws-sdk-java-v2 , calcite , debezium , docker-java , httpcomponents-client , infinispan , java-client , java-opensaml , java-shib-shared , jersey , jetcd , metrics , micrometer , micrometer-tracing , openai-java , oxia-client-java , testcontainers-java , wiremock , ws-wss4j
Affected packages:
httpclient5 @ 5.3.1 (+3569 more)

Fixes