CVE-2026-64607 — Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS

Description (CNA)

HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-Encoding` header value in the response message. Please note this defect does not affect HttpClient based on the async i/o model. This issue affects Apache HttpComponents Client: from 5.0-alpha1 through 5.6.2.

Affected (CNA)

Vendor / product	Versions
Apache Software Foundation / Apache HttpComponents Client	affected 5.0-alpha through 5.6.2

CWE

CWE-772

References

https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.

http://www.openwall.com/lists/oss-security/2026/08/13/5