CVE-2026-64607 Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS

🗓️ 31 Jul 2026 10:12:18Reported by apacheType

HttpComponents Client leaks connections on Content-Encoding decode error, causing pool exhaustion.

Reporter	Title	Published	Views	Family All 421
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to Missing Release of Resource after Effective Lifetime and Improper Certificate Validation due to HttpClient (CVE-2026-64607 & CVE-2026-71290)	4 Sep 202612:46	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities	7 Sep 202607:04	–	ibm
IBM Security Bulletins	Security Bulletin: IBM i is Affected By Holding Resources after Effective Lifetime Vulnerability in Electronic Service Agent [CVE-2026-64607]	21 Aug 202620:02	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Quantum Safe Explorer is affected by multiple vulnerabilities	31 Aug 202606:49	–	ibm
ATTACKERKB	CVE-2026-64607	31 Jul 202610:12	–	attackerkb
Chainguard	CVE-2026-64607 vulnerabilities	14 Aug 202620:25	–	cgr
Circl	CVE-2026-64607	13 Aug 202622:22	–	circl
CVE	CVE-2026-64607	31 Jul 202610:12	–	cve
Debian CVE	CVE-2026-64607	31 Jul 202610:12	–	debiancve
EUVD	EUVD-2026-51519	31 Jul 202610:12	–	euvd

[
  {
    "collectionURL": "https://repo.maven.apache.org/maven2/",
    "defaultStatus": "unaffected",
    "packageName": "org.apache.httpcomponents.client5:httpclient5",
    "product": "Apache HttpComponents Client",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "5.6.2",
        "status": "affected",
        "version": "5.0-alpha",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
lists	www.lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q

13 Aug 2026 08:51Current

EPSS0.00482

CWE-772