EUVD-2026-51519

🗓️ 31 Jul 2026 10:12:18Reported by EUVDType

Classic I/O HttpClient fails to release on invalid Content-Encoding; async I/O is unaffected.

Reporter	Title	Published	Views	Family All 457
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to Missing Release of Resource after Effective Lifetime and Improper Certificate Validation due to HttpClient (CVE-2026-64607 & CVE-2026-71290)	4 Sep 202612:46	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities in Apache HttpComponents Client affect IBM Content Navigator	28 Sep 202610:07	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities affect IBM Tivoli Netcool Impact	29 Sep 202614:28	–	ibm
IBM Security Bulletins	Security Bulletin:Vulnerability in httpclient5-5.5.jar may affect IBM Infosphere Change Data Capture (CVE-2026-64607)	14 Sep 202610:14	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities	7 Sep 202607:04	–	ibm
IBM Security Bulletins	Security Bulletin: IBM i is Affected By Holding Resources after Effective Lifetime Vulnerability in Electronic Service Agent [CVE-2026-64607]	21 Aug 202620:02	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Quantum Safe Explorer is affected by multiple vulnerabilities	28 Sep 202606:43	–	ibm
IBM Security Bulletins	Security Bulletin: HttpClient based on the classic i/o model fails to correctly release the underlying connection	24 Sep 202620:19	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Manage application in IBM Maximo Application Suite uses jackson-databind-2.18.9.jar and httpclient5-5.3.1.jar and is vulnerable to CVE-2026-19032, CVE-2026-83557, CVE-2026-68497 and CVE-2026-64607	1 Oct 202610:01	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Quantum Safe Explorer is affected by multiple vulnerabilities	31 Aug 202606:49	–	ibm

[
  {
    "enisaIdVendor": [
      {
        "id": "ed7da026-bdcc-3644-81bb-19aacb534a09",
        "vendor": {
          "name": "Apache Software Foundation"
        }
      }
    ],
    "enisaIdProduct": [
      {
        "id": "c8e2a601-777c-3209-ba34-7391ff195166",
        "product": {
          "name": "Apache HttpComponents Client",
          "vendor": {
            "name": "Apache Software Foundation"
          }
        },
        "product_version": "5.0-alpha ≤5.6.2"
      }
    ]
  }
]

Source	Link
lists	www.lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q

31 Jul 2026 16:25Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.15.3

EPSS0.00464

SSVC