Connection Management Flaw in Apache HttpComponents Client

CVE-2026-64607

What is CVE-2026-64607?

A flaw exists in the Apache HttpComponents Client where the library fails to properly release connections back to the connection manager upon encountering an invalid or unsupported 'Content-Encoding' header in the HTTP response. This issue primarily impacts versions of the HttpClient based on the classic I/O model, potentially leading to resource exhaustion or connection leaks, thereby diminishing performance and reliability.

References