Apache HttpComponents Client up to 5.6.2 HttpClient allocation of resources

Summaryinfo

A vulnerability was found in Apache HttpComponents Client up to 5.6.2. It has been rated as problematic. This affects an unknown function of the component HttpClient. This manipulation causes allocation of resources. This vulnerability appears as CVE-2026-64607. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability was found in Apache HttpComponents Client up to 5.6.2. It has been declared as problematic. Affected by this vulnerability is an unknown function of the component HttpClient. The manipulation with an unknown input leads to a allocation of resources vulnerability. The CWE definition for the vulnerability is CWE-770. The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor. As an impact it is known to affect availability. The summary by CVE is:

HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-Encoding` header value in the response message. Please note this defect does not affect HttpClient based on the async i/o model. This issue affects Apache HttpComponents Client: from 5.0-alpha1 through 5.6.2.

It is possible to read the advisory at lists.apache.org. This vulnerability is known as CVE-2026-64607 since 07/20/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 07/31/2026). The attack technique deployed by this issue is T1499 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-51519). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Apache

Name

• HttpComponents Client

Version

• 5.6.0
• 5.6.1
• 5.6.2

License

• open-source

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion