CVE-2026-64607 | BDVDB-2026-354473 Detail
ApacheApache HttpComponents Client
Description#
HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-Encoding` header value in the response message. Please note this defect does not affect HttpClient based on the async i/o model. This issue affects Apache HttpComponents Client: from 5.0-alpha1 through 5.6.2.
Impact#
Per CVSS v3.1: confidentiality impact none, integrity impact none, availability impact low. Attack vector: network.
Weaknesses#
- CWE-772 Missing Release of Resource after Effective Lifetime
References#
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.