SUSE-SU-2026:4028-1 Security update for httpcomponents-client

This update for httpcomponents-client fixes the following issue: - CVE-2026-64607: improper release of underlying connection back to connection manager when an invalid or unsupported Content-Encoding header value in a response message bsc1273163...

Security Bulletin: Vulnerabilities exists in IBM Netezza Software

Summary Vulnerabilities identified in IBM Netezza Software have been addressed in version 11.3.1.4. Vulnerability Details CVEID:CVE-2025-14920 DESCRIPTION: Hugging Face Transformers Perceiver Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows...

CLSA-2026-1788763778 TuxCare security update for org.apache.httpcomponents.core5 (2 CVEs)

TuxCare rebuilt 5 org.apache.httpcomponents.core5 packages to address 2 CVEs. Fixed in 5.2.5-tuxcare.1...

org.apache.httpcomponents.client5/httpclient5: Apache HttpComponents Client: Server impersonation via improper TLS hostname verification

A flaw was found in the asynchronous version of Apache HttpComponents Client. This improper Transport Layer Security TLS hostname verification vulnerability allows a remote attacker to intercept and modify network traffic. By presenting a valid certificate for a different domain, an attacker can...

org.apache.httpcomponents.client5/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak

A flaw was found in Apache HttpComponents Client, specifically in its classic input/output I/O model. When processing a response message with an invalid or unsupported Content-Encoding header, the client fails to properly release the underlying network connection. This connection leak can lead to...

Important: Red Hat Security Advisory: Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.3.SP1)

An update for Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available RHBQ 3.33.3.SP1.The purpose of this text-only errata is to inform you about the enhancements that improve your developer experience and ensure the security and stability of your products.Red Hat Product...

httpcomponents-client-4.5.14-2.1 on GA media (moderate)

httpcomponents-client-4.5.14-2.1 on GA media Announcement ID: openSUSE-SU-2026:11647-1 Rating: moderate Cross-References: CVE-2026-64607 CVSS scores: CVE-2026-64607 SUSE : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2026-64607 SUSE : 6.9...

Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining Interim Fix for August 2026

Summary Multiple vulnerabilities were addressed in IBM Process Mining 2.2.0 IF002 Vulnerability Details CVEID:CVE-2026-41608 DESCRIPTION: Improper Handling of Highly Compressed Data Data Amplification vulnerability in Apache Thrift Python bindings. This issue affects Apache Thrift: before 0.24.0...

CVE-2026-64607

A flaw was found in Apache HttpComponents Client, specifically in its classic input/output I/O model. When processing a response message with an invalid or unsupported Content-Encoding header, the client fails to properly release the underlying network connection. This connection leak can lead to...

OPENSUSE-SU-2026:11647-1 httpcomponents-client-4.5.14-2.1 on GA media

These are all security issues fixed in the httpcomponents-client-4.5.14-2.1 package on the GA media of openSUSE Tumbleweed...

Security Bulletin: IBM Integrated Analytics System (IIAS) is affected by an uncontrolled resource consumption vulnerability due to Apache HttpComponents Core

Summary Apache HttpComponents Core is used by IBM Integrated Analytics System as a Java library providing low-level HTTP transport components. CVE-2026-54399 affects the HTTP/1.1 message parser in Apache HttpComponents Core versions 5.4.2 and earlier, where insufficient limits on the number and...

Improper Resource Shutdown

Apache HttpComponents Client is vulnerable to Improper Resource Shutdown. The vulnerability is due to the classic I/O model failing to release connections back to the connection manager when processing an invalid or unsupported Content-Encoding header value, potentially exhausting available...

Amazon Linux 2023 : javapackages-bootstrap (ALAS2023-2026-2055)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2055 advisory. Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core 5.4.2 and earlier, 5.5-beta1 and earlier allows an remote attacker to cause a denial of...

CVE-2026-71290

A flaw was found in the asynchronous version of Apache HttpComponents Client. This improper Transport Layer Security TLS hostname verification vulnerability allows a remote attacker to intercept and modify network traffic. By presenting a valid certificate for a different domain, an attacker can...

Security Bulletin: Improper input validation, integer overflow, and other vulnerabilities might affect IBM Storage Defender - Resiliency Service

Summary IBM Storage Defender - Resiliency Service is vulnerable to improper input validation, integer overflow, and others. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2026-54399 DESCRIPTION: Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message pars...

CLSA-2026-1786947088 TuxCare security update for org.apache.httpcomponents (1 CVE)

TuxCare rebuilt 6 org.apache.httpcomponents packages to address 1 CVE. Fixed in 4.2.6-tuxcare.1...

Important: javapackages-bootstrap

Issue Overview: Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core 5.4.2 and earlier, 5.5-beta1 and earlier allows an remote attacker to cause a denial of service through memory exhaustion by sending messages with excessive number of heade...

SUSE CVE-2026-71290

Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicyBUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonat...

org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks

A flaw was found in Apache HttpComponents Core. This vulnerability, located in the HTTP/2 HPACK decoder, allows a remote attacker to cause a denial of service. By sending oversized compressed header blocks, an attacker can exhaust memory resources before the system's configured header list size...

Linux Distros Unpatched Vulnerability : CVE-2026-71290

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicyBUILTIN setting has no effect when used...