CVE-2026-64607— Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS
Possible ATT&CK Techniques 1AI
T1496 · Resource HijackingAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Apache Software Foundation | Apache HttpComponents Client | 5.0-alpha≤ 5.6.2 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-64607
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS
Source: CVE Program / CVE List V5
Vulnerability Description
HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-Encoding` header value in the response message. Please note this defect does not affect HttpClient based on the async i/o model. This issue affects Apache HttpComponents Client: from 5.0-alpha1 through 5.6.2.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
对已超过有效生命周期的资源丧失索引
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache HttpComponents Client | 5.0-alpha ~ 5.6.2 | - |
II. Public POCs for CVE-2026-64607
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-64607
请登录查看更多情报信息。
Mailing List Discussions for CVE-2026-64607 (1)
Same Patch Batch · Apache Software Foundation · 2026-07-31 · 3 CVEs total
| CVE-2026-62391 | Apache Kyuubi: kyuubi.session.local.dir.allow.list bypass via unprefixed Spark file-conf a | |
| CVE-2026-44615 | Path traversal in NotebookRepo note and folder path composition |
IV. Related Vulnerabilities
Same vendor: Apache Software Foundation
- CVE-2026-44615
Path traversal in NotebookRepo note and folder path composit - CVE-2026-62391
Apache Kyuubi: kyuubi.session.local.dir.allow.list bypass vi - CVE-2026-66756
Apache Tika: unpack endpoint in tika-server allows configura - CVE-2026-66755
Apache Tika: Arbitrary Local File Read in ISArchiveParser - CVE-2026-23985
Apache Superset: Regular Expression Denial of Service (ReDoS
Same weakness: CWE-772
- CVE-2026-12353
Rhcs: memory leak during https connection leads to denial of - CVE-2026-56444
Degradation of resolution service when 'discard-timeout' and - CVE-2026-41637
Degradation of resolution service from improperly accounted - CVE-2026-15713
Libsoup: soupcache: libsoup: http/2 frame window exhaustion - CVE-2026-54786
Wasmtime: Leak in WASIp1 `fd_renumber` implementation
V. Comments for CVE-2026-64607
No comments yet