CVE-2026-64607

Name of the Vulnerable Software and Affected Versions Apache HttpComponents Client versions 5.0-alpha1 through 5.6.2

Description HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager when it encounters an invalid or unsupported Content-Encoding header value in the response message. This failure can lead to connection pool exhaustion, resulting in a Denial of Service (DoS). This issue does not affect HttpClient based on the async i/o model.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.