CVE-2026-64607

Overview

Apache HttpComponents Client (HttpClient) is an efficient, up-to-date and feature-rich Java library implementing the client side of the most recent HTTP standards and recommendations. It is designed for extension while providing robust support for the base HTTP protocol, and is used to build HTTP-aware client applications such as web service clients. HttpClient 5.x is published to Maven Central under org.apache.httpcomponents.client5: httpclient5 provides the classic and async clients, httpclient5-fluent a fluent facade, httpclient5-cache HTTP response caching and httpclient5-win Windows-native authentication. It is built on Apache HttpComponents Core 5.

A denial of service vulnerability (CVE-2026-64607) has been identified in the classic (blocking I/O) client of Apache HttpComponents Client, which allows attackers who control HTTP responses to leak pooled connections by returning an invalid or unsupported Content-Encoding header value. Each leaked connection is never released back to the connection manager, so repeated responses can exhaust the connection pool. The async client is not affected. In HttpClient 5.1.x, clients created with the standard builders are not exposed in their default configuration (see Vulnerability Info).

Per OWASP: The Denial of Service (DoS) attack is focused on making a resource (site, application, server) unavailable for the purpose it was designed.

This issue affects multiple versions of Apache HttpComponents Client.

Details

Module Info

• Product: Apache HttpComponents Client
• Affected packages: org.apache.httpcomponents.client5:httpclient5
• Affected versions: >=5.0-alpha1 <=5.6.2
• GitHub repository: https://github.com/apache/httpcomponents-client
• Published packages: https://central.sonatype.com/artifact/org.apache.httpcomponents.client5/httpclient5
• Package manager: Maven
• Fixed in:
  • OSS Apache HttpComponents Client 5.6.3, 5.7-alpha1
  • NES for Apache HttpComponents Client v5.1.6

Vulnerability Info

This Medium-severity vulnerability is found in the org.apache.httpcomponents.client5:httpclient5 package in multiple versions of Apache HttpComponents Client. In the classic client, ContentCompressionExec.execute obtains the response from the rest of the execution chain and then inspects the entity's Content-Encoding value to wrap the entity in a decompressing decoder. That post-processing runs with no error handling around the response:

final ClassicHttpResponse response = chain.proceed(request, scope);

final HttpEntity entity = response.getEntity();
if (requestConfig.isContentCompressionEnabled() && entity != null && entity.getContentLength() != 0) {
    final String contentEncoding = entity.getContentEncoding();
    if (contentEncoding != null) {
        final ParserCursor cursor = new ParserCursor(0, contentEncoding.length());
        final HeaderElement[] codecs = BasicHeaderValueParser.INSTANCE.parseElements(contentEncoding, cursor);
        for (final HeaderElement codec : codecs) {
            final String codecname = codec.getName().toLowerCase(Locale.ROOT);
            final InputStreamFactory decoderFactory = decoderRegistry.lookup(codecname);
            if (decoderFactory != null) {
                response.setEntity(new DecompressingEntity(response.getEntity(), decoderFactory));
                ...
            } else {
                if (!"identity".equals(codecname) && !ignoreUnknown) {
                    throw new HttpException("Unsupported Content-Encoding: " + codec.getName());
                }
            }
        }
    }
}
return response;

When an HttpException or a runtime exception is thrown after chain.proceed returns, the response is never closed. InternalHttpClient.doExecute then converts the HttpException into a ClientProtocolException without discarding the connection endpoint, so the connection leased for the exchange is never returned to the connection manager. Because the caller only receives an exception, it holds no response object it could close to recover the connection.

A malicious or compromised server can send responses with an unsupported Content-Encoding value to trigger this path on every request. Each failed exchange leaks one pooled connection, and once the per-route or total connection limit is reached, further requests wait for a connection that is never freed and fail once the connection request timeout expires, denying service to the application.

In the 5.1 series, HttpClientBuilder creates ContentCompressionExec with ignoreUnknown set to true, so a client built with the default builder skips unknown codings instead of throwing. HttpClientBuilder, which the fluent API and CachingHttpClientBuilder also build on, has no option to change this, so default-configured 5.1.x clients are not exploitable. On those versions the leak is reached only when an application installs its own ContentCompressionExec with ignoreUnknown set to false ahead of the protocol and connection stages of the execution chain, for example in place of the builder's own decompression step.

Mitigation

Apache HttpComponents Client 5.1.4, released in November 2022, is the last release of the 5.1 series, and its release notes advise HttpClient 5.1 users to upgrade, so no 5.1.x release is available to address this issue. For more information, see here.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to a currently supported release of Apache HttpComponents Client that contains the fix.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• Yu Bao from PayPal Cyber Security Team (finder)