Bug 2509736 (CVE-2026-64607)

Summary: CVE-2026-64607 org.apache.httpcomponents/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: ant, avibelli, bgeorges, ccranfor, cescoffi, cmah, dandread, dhanak, dkreling, drosa, dsimansk, ewittman, fmariani, fmongiar, gmalinko, gsmet, janstey, jmartisk, jnethert, jpechane, jwon, kaycoth, kingland, lthon, manderse, mcarlett, mnovotny, mosmerov, nipatil, olubyans, pantinor, pesilva, pgallagh, pjindal, probinso, rguimara, rhel-process-autobot, rkubis, rruss, rstepani, rsvoboda, sausingh, sbiarozk, sdawley, tcunning, tqvarnst, watson-tool-maintainers, yfang
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Apache HttpComponents Client, specifically in its classic input/output (I/O) model. When processing a response message with an invalid or unsupported `Content-Encoding` header, the client fails to properly release the underlying network connection. This connection leak can lead to the exhaustion of the connection pool, making the service unavailable and resulting in a Denial of Service (DoS) for legitimate users.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-07-31 11:01:14 UTC
HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-Encoding` header value in the response message. Please note this defect does not affect HttpClient based on the async i/o model.

This issue affects Apache HttpComponents Client: from 5.0-alpha1 through 5.6.2.