Missing Release of Resource after Effective Lifetime in Apache HttpComponents Client - CVE-2026-64607

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU144885

Missing Release of Resource after Effective Lifetime in Apache HttpComponents Client - CVE-2026-64607

Published: August 24, 2026


Vulnerability identifier: #VU144885
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-64607
CWE-ID: CWE-772
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper resource management in the classic i/o model HttpClient connection handling when processing a response with an invalid or unsupported content-encoding header value. A remote attacker can send a response with an invalid or unsupported content-encoding header value to cause a denial of service.

Only the classic i/o model is affected; the async i/o model is not affected.


Affected software

Apache HttpComponents Client
IBM App Connect Enterprise
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
Development Tools Module
IBM Content Navigator
Informix Dynamic Server
httpcomponents-client

How to mitigate CVE-2026-64607

Install security update from vendor's website.

Apache HttpComponents Client - update to 5.6.3
IBM Content Navigator - addressed in versions 3.1.0 IF013, 3.2.0 IF008, 26.0.0 IF003
Informix Dynamic Server - addressed in versions 14.10.FC14W1, 15.0.1.16
IBM App Connect Enterprise - update to 13.0.8.2
httpcomponents-client - update to 4.5.14-150200.3.12.1

External References

Related Security Bulletins