Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS
Priority LOW 30CWE-772Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- Partial Red Hat: 16 fixed, 5 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-772.
Summary
HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-Encoding` header value in the response message. Please note this defect does not affect HttpClient based on the async i/o model. This issue affects Apache HttpComponents Client: from 5.0-alpha1 through 5.6.2.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00464 40th percentileScored 2026-11-07
Fix Partial org.apache.httpcomponents.client5:httpclient5 (Maven): 5.6.3Red Hat: 16 advisoriesRed Hat: 16 fixed, 5 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache HttpComponents Client | 5.0-alpha – 5.6.2 | — | No fix listed | CNA |
| — | org.apache.httpcomponents.client5:httpclient5 (Maven) | 5.0-alpha1 to before 5.6.3 | 5.6.3 | Patch available | GHSA-hjcp-jmpx-g3qm |
- Apache HttpComponents Client VendorApache Affected 5.0-alpha – 5.6.2 Fixed in — No fix listed CNA
- org.apache.httpcomponents.client5:httpclient5 (Maven) Vendor— Affected 5.0-alpha1 to before 5.6.3 Fixed in 5.6.3 Patch available GHSA-hjcp-jmpx-g3qm
Remediation
- Fix · GHSA-hjcp-jmpx-g3qm org.apache.httpcomponents.client5:httpclient5 (Maven) Fixed in 5.6.3 Advisory →
Red Hat 16 advisories
- RHSA-2026:90321 Released 2026-10-26 · Red Hat rating CriticalRed Hat OpenShift Dev Spaces 3.31.0 Release.
- Red Hat OpenShift Dev Spaces 3.31 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/jetbrains-ide-rhel9 +8
- RHSA-2026:83612 Released 2026-10-15 · Red Hat rating ImportantRed Hat build of Debezium 3.6.3 release
- Red Hat Build of Debezium 3.6
- RHSA-2026:71675 Released 2026-09-24 · Red Hat rating ImportantRed Hat Build of Apache Camel 4.18.4 for Spring Boot release.
- Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16
Show 13 more Red Hat advisories
- RHSA-2026:63302 Released 2026-09-03 · Red Hat rating ImportantRed Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.3.SP1)
- Red Hat Build of Apache Camel 3.33.3.SP1 io.netty.netty-codec-http-4.1.137.Final-redhat-00001.jar, io.netty.netty-handler-4.1.137.Final-redhat-00001.jar, io.quarkus.quarkus-qute-3.33.3.redhat-00005.jar +5
- RHSA-2026:62515 Released 2026-09-03 · Red Hat rating ImportantRed Hat build of Quarkus 3.27.5.SP1 release and security update
- Red Hat build of Quarkus 3.27.5.SP1 io.netty.netty-codec-http-4.1.137.Final-redhat-00001.jar, io.netty.netty-handler-4.1.137.Final-redhat-00001.jar, io.quarkus.quarkus-apache-httpclient-3.27.5.redhat-00004.jar +7
- RHSA-2026:60259 Released 2026-08-26 · Red Hat rating ImportantRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.20 security update.
- OpenShift Developer Tools and Services 4.20 registry.redhat.io/ocp-tools-4/jenkins-rhel9
- RHSA-2026:60256 Released 2026-08-26 · Red Hat rating ImportantRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.22 security update.
- OpenShift Developer Tools and Services 4.22 registry.redhat.io/ocp-tools-4/jenkins-rhel9
- RHSA-2026:60254 Released 2026-08-26 · Red Hat rating ImportantRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.21 security update.
- OpenShift Developer Tools and Services 4.21 registry.redhat.io/ocp-tools-4/jenkins-rhel9
- RHSA-2026:60252 Released 2026-08-26 · Red Hat rating ImportantRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.19 security update.
- OpenShift Developer Tools and Services 4.19 registry.redhat.io/ocp-tools-4/jenkins-rhel9
- RHSA-2026:60251 Released 2026-08-26 · Red Hat rating ImportantRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.16 security update.
- OpenShift Developer Tools and Services 4.16 registry.redhat.io/ocp-tools-4/jenkins-rhel9
- RHSA-2026:60250 Released 2026-08-26 · Red Hat rating ImportantRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.18 security update.
- OpenShift Developer Tools and Services 4.18 registry.redhat.io/ocp-tools-4/jenkins-rhel9
- RHSA-2026:60249 Released 2026-08-26 · Red Hat rating ImportantRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.13 security update.
- OpenShift Developer Tools and Services 4.13 registry.redhat.io/ocp-tools-4/jenkins-rhel8
- RHSA-2026:60248 Released 2026-08-26 · Red Hat rating ImportantRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.14 security update.
- OpenShift Developer Tools and Services 4.14 registry.redhat.io/ocp-tools-4/jenkins-rhel8
- RHSA-2026:60247 Released 2026-08-26 · Red Hat rating ImportantRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.12 security update.
- OpenShift Developer Tools and Services 4.12 registry.redhat.io/ocp-tools-4/jenkins-rhel8
- RHSA-2026:60246 Released 2026-08-26 · Red Hat rating ImportantRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.17 security update.
- OpenShift Developer Tools and Services 4.17 registry.redhat.io/ocp-tools-4/jenkins-rhel9
- RHSA-2026:60239 Released 2026-08-26 · Red Hat rating ImportantRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.15 security update.
- OpenShift Developer Tools and Services 4.15 registry.redhat.io/ocp-tools-4/jenkins-rhel8
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenShift Serverless | Affected | No fix yet |
| Red Hat Enterprise Linux 9 | Affected | No fix yet |
| Red Hat build of Apache Camel 4 for Quarkus 3 | Affected | No fix yet |
| Red Hat build of Apicurio Registry 3 | Affected | No fix yet |
| Red Hat build of Debezium 3 | Affected | No fix yet |
| OpenShift Developer Tools and Services 4.12 | Fixed | RHSA-2026:60247 |
| OpenShift Developer Tools and Services 4.13 | Fixed | RHSA-2026:60249 |
| OpenShift Developer Tools and Services 4.14 | Fixed | RHSA-2026:60248 |
| OpenShift Developer Tools and Services 4.15 | Fixed | RHSA-2026:60239 |
| OpenShift Developer Tools and Services 4.16 | Fixed | RHSA-2026:60251 |
| OpenShift Developer Tools and Services 4.17 | Fixed | RHSA-2026:60246 |
| OpenShift Developer Tools and Services 4.18 | Fixed | RHSA-2026:60250 |
| OpenShift Developer Tools and Services 4.19 | Fixed | RHSA-2026:60252 |
| OpenShift Developer Tools and Services 4.20 | Fixed | RHSA-2026:60259 |
| OpenShift Developer Tools and Services 4.21 | Fixed | RHSA-2026:60254 |
| OpenShift Developer Tools and Services 4.22 | Fixed | RHSA-2026:60256 |
| Red Hat Build of Apache Camel 3.33.3.SP1 | Fixed | RHSA-2026:63302 |
| Red Hat Build of Debezium 3.6 | Fixed | RHSA-2026:83612 |
| Red Hat OpenShift Dev Spaces 3.31 | Fixed | RHSA-2026:90321 |
| Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16 | Fixed | RHSA-2026:71675 |
| Red Hat build of Quarkus 3.27.5.SP1 | Fixed | RHSA-2026:62515 |
Not affected: 18 products
- OpenShift Developer Tools and Services
- OpenShift Developer Tools and Services 4.12
- OpenShift Developer Tools and Services 4.13
- OpenShift Developer Tools and Services 4.14
- OpenShift Developer Tools and Services 4.15
- OpenShift Developer Tools and Services 4.16
- OpenShift Developer Tools and Services 4.17
- OpenShift Developer Tools and Services 4.18
- OpenShift Developer Tools and Services 4.19
- OpenShift Developer Tools and Services 4.20
- OpenShift Developer Tools and Services 4.21
- OpenShift Developer Tools and Services 4.22
- Red Hat Build of Apache Camel 3.33.3.SP1
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift Dev Spaces
- Red Hat OpenShift Dev Spaces 3.31
- Red Hat build of Apache Camel 4 for Quarkus 3
- Red Hat build of Quarkus 3.27.5.SP1
Timeline
- 2026-10-02 Threatist record created from CVE-2026-64607
- 2026-10-03 Alias added: GHSA-hjcp-jmpx-g3qm
- 2026-10-09 Fix available: RHSA-2026:63302 · Red Hat
- 2026-10-09 Fix available: RHSA-2026:62515 · Red Hat
- 2026-10-09 Fix available: Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP1, Red Hat build of Quarkus 3.27.5.SP1 · Red Hat
- 2026-10-12 Fix available: Red Hat Build of Apache Camel 3.33.3.SP1 · Red Hat
- 2026-10-16 Fix available: RHSA-2026:83612 · Red Hat
- 2026-10-16 Fix available: Red Hat Build of Debezium 3.6 · Red Hat
- 2026-10-20 Affected versions changed · Red Hat
- 2026-10-29 Fix available: Red Hat OpenShift Dev Spaces 3.31 · Red Hat
- 2026-10-30 Fix available: RHSA-2026:90321 · Red Hat
References
Advisory 2
Other 6
- https://github.com/apache/httpcomponents-client/commit/55733f4121f7ba26ddf04fe12739d9c15962cb94
- https://github.com/apache/httpcomponents-client/commit/ebac9512f555c4a355cad3f59ef2db69b597cc97
- https://github.com/apache/httpcomponents-client
- https://github.com/apache/httpcomponents-client/releases/tag/rel/v5.6.3
- https://github.com/apache/httpcomponents-client/releases/tag/rel/v5.7-alpha1
- http://www.openwall.com/lists/oss-security/2026/08/13/5
More Apache Httpclient vulnerabilities
- TI-2013-03825 http/impl/client/HttpClientBuilder.java in Apache HttpClient 4.3.x before 4.3.1 does not… CVSS 3.1CRITICAL 9.8
- TI-2026-49957 Apache HttpComponents Client: TLS hostname verification silently disabled on the async transport (default config, MITM) CVSS 3.1CRITICAL 9.1
- TI-2020-10932 Improper input validation in Apache HttpClient CVSS 3.1MEDIUM 5.3
- TI-2025-20592 Apache HttpComponents: PSL (Public Suffix List) validation bypass CVSS 3.1HIGH 7.5
- TI-2026-29288 Apache HttpClient: SCRAM-SHA-256 mutual authentication bypass may cause the client to… CVSS 3.1HIGH 7.3
- TI-2015-04421 http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before… CVSS 2.0MEDIUM 4.3
Sources
- CVE-2026-64607 · CVE Program
- CVE-2026-64607 · NVD
- FIRST EPSS
- GHSA-hjcp-jmpx-g3qm · GitHub Advisory Database · CC BY 4.0
- CVE-2026-64607 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences