CVE-2026-64607: Apache HttpComponents Client DOS Flaw

CVE-2026-64607 Overview

CVE-2026-64607 is a connection management defect in Apache HttpComponents Client. The classic i/o model of HttpClient fails to release the underlying connection back to the connection manager when a response contains an invalid or unsupported Content-Encoding header value. Over time, this leak exhausts the connection pool and degrades application availability. The async i/o model is not affected. Versions 5.0-alpha1 through 5.6.2 of Apache HttpComponents Client are vulnerable, and the weakness is classified as missing release of resource after effective lifetime [CWE-772].

Critical Impact
A remote server returning malformed Content-Encoding headers can trigger connection pool exhaustion in client applications, producing a low-availability denial-of-service condition without requiring authentication or user interaction.

Affected Products

Apache HttpComponents Client 5.0-alpha1 through 5.6.2 (classic i/o model)
Java applications embedding vulnerable HttpClient releases
Server-side services that make outbound HTTP requests using the classic HttpClient API

Discovery Timeline

2026-07-31 - CVE-2026-64607 published to NVD
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2026-64607

Vulnerability Analysis

Apache HttpComponents Client uses a connection manager to pool and reuse TCP connections across HTTP requests. When the classic i/o code path receives a response, it inspects the Content-Encoding header to select a decompression handler such as gzip or deflate. If the header value is invalid or references an unsupported encoding, the client raises an error before the response entity is fully consumed. The exception path does not return the underlying connection to the pool. Each malformed response consumes one slot in the connection manager permanently. Sustained traffic against a hostile or misbehaving server drains the pool, and subsequent request attempts stall or fail with connection acquisition timeouts.

Root Cause

The root cause is a missing release of a pooled resource after its effective lifetime [CWE-772]. The classic i/o response handler treats an unknown Content-Encoding as a fatal parsing error and propagates the exception without invoking the connection release logic that would normally run when the entity stream is closed. The async i/o pipeline handles the same condition through a different state machine and correctly returns the connection.

Attack Vector

An attacker who controls or influences an HTTP server contacted by a vulnerable client can return arbitrary values in the Content-Encoding response header. Attack scenarios include compromised upstream APIs, malicious redirect targets, and man-in-the-middle interception of plaintext traffic. The attacker sends repeated responses with invalid encodings until the target client's connection pool is exhausted. No authentication is required and the impact is limited to availability of the client application.

See the Apache Security Mailing List Thread for the maintainers' technical description of the defect.

Detection Methods for CVE-2026-64607

Indicators of Compromise

Repeated ConnectionPoolTimeoutException or Timeout waiting for connection from pool errors in application logs.
Steadily rising count of leased connections reported by PoolingHttpClientConnectionManager metrics without a matching release rate.
HTTP responses from upstream services containing non-standard Content-Encoding values such as random tokens or unsupported algorithms.

Detection Strategies

Inventory Java dependencies for org.apache.httpcomponents.client5:httpclient5 versions between 5.0-alpha1 and 5.6.2 using software composition analysis tooling.
Instrument outbound HTTP traffic to alert on responses whose Content-Encoding header is not gzip, deflate, br, identity, or an empty value.
Track connection pool saturation as a service-level indicator and alert when leased connections approach the configured maximum.

Monitoring Recommendations

Emit JMX or Micrometer metrics from PoolingHttpClientConnectionManager and forward them to a centralized observability platform.
Correlate pool exhaustion events with the identity of the upstream host to isolate the offending server.
Capture packet or proxy logs at egress points to retain evidence of malformed response headers for incident review.

How to Mitigate CVE-2026-64607

Immediate Actions Required

Upgrade Apache HttpComponents Client to a fixed release once published by the Apache HttpComponents project.
Audit application code for direct use of the classic CloseableHttpClient API and prioritize those services for patching.
Restrict outbound HTTP calls to trusted upstream endpoints using egress filtering while a patch is being deployed.

Patch Information

Apache HttpComponents Client versions 5.0-alpha1 through 5.6.2 are affected. Consult the Apache Security Mailing List Thread for the fixed version and upgrade guidance from the project maintainers.

Workarounds

Migrate the affected code paths to the async i/o model (CloseableHttpAsyncClient), which is not affected by this defect.
Wrap outbound request execution in code that explicitly aborts the request and closes the response on any exception to force connection release.
Configure a conservative evictIdleConnections and evictExpiredConnections policy on the connection manager to reclaim leaked connections faster.

bash

# Configuration example: enforce idle and expired connection eviction
# in a Maven-managed Java application using HttpComponents Client 5.x

# 1. Pin the dependency to a fixed release once available
mvn dependency:tree | grep httpclient5

# 2. In application code, construct the client with eviction enabled
#    CloseableHttpClient client = HttpClients.custom()
#        .setConnectionManager(connectionManager)
#        .evictIdleConnections(TimeValue.ofSeconds(30))
#        .evictExpiredConnections()
#        .build();