CVE-2026-64607

5.3 Moyenne

Publiée le 31/07/2026 à 13:17 · Modifiée le 13/08/2026 à 19:17 · Modifiée · Source : security@apache.org

Description

HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-Encoding` header value in the response message. Please note this defect does not affect HttpClient based on the async i/o model. This issue affects Apache HttpComponents Client: from 5.0-alpha1 through 5.6.2.

Traduire en français

Produits concernés

Apache Software Foundation Apache HttpComponents Client
Apache httpclient

Scores CVSS

Version	Score	Source	Vecteur
3.1	5.3 Moyenne	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L`

Faiblesses (CWE)

CWE-772

Références

https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q Mailing ListRelease Notes
http://www.openwall.com/lists/oss-security/2026/08/13/5

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories