CVE-2026-64607: apache software foundation apache httpcomponents client

CVSS: 5.3v3.1MediumModified

AliasesSUSE-SU-2026:4028-1UBUNTU-CVE-2026-64607DEBIAN-CVE-2026-64607+360 more

Published 31-07-2026Last modified 13-08-2026

Vulnerability summary

CVE-2026-64607 is a medium (CVSS 5.3) vulnerability in apache software foundation apache httpcomponents client. EPSS estimates a 0.46% chance of exploitation in the next 30 days, higher than 38.8% of scored vulnerabilities.

Overall risk

21/100

0100

Low · default modelHow is this calculated?

CVSS score

5.3/10

010

Medium · v3.1 (CVE.org)

EPSS score

0.46%

0%100%

Low · -0.02 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 0 · Related 1

CGA-6655-WM2F-CQMX

Timeline

31-07-2026
PublishedVulnerability first disclosed.
13-08-2026
Last modifiedVulnerability information updated.

Description

HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-Encoding` header value in the response message. Please note this defect does not affect HttpClient based on the async i/o model. This issue affects Apache HttpComponents Client: from 5.0-alpha1 through 5.6.2.

CVSS metrics

7 scores · 7 sources · 1 version

v3.15.3

EPSS trend

Probability

0.46%

Chance of exploitation in the next 30 days

Percentile

39%

Versus all other CVEs

30-day change

-0.02 pp

From 0.48% on 19-09-2026

19-09-202619-10-2026

EPSS score

0.46%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-772Missing Release of Resource after Effective LifetimeThe product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.

Affected systems

Chainguard146 products

airbyte-platform-bootloader< 2.0.0-r7
airbyte-platform-cron< 2.0.0-r7
airbyte-platform-fips-bootloader< 2.0.0-r6
airbyte-platform-fips-cron< 2.0.0-r6
airbyte-platform-fips-server< 2.0.0-r6

airbyte-platform-fips-workers< 2.0.0-r6
airbyte-platform-fips-workload-api-server< 2.0.0-r6
airbyte-platform-fips-workload-launcher< 2.0.0-r6
airbyte-platform-server< 2.0.0-r7
airbyte-platform-workers< 2.0.0-r7
airbyte-platform-workload-api-server< 2.0.0-r7
airbyte-platform-workload-launcher< 2.0.0-r7
airbyte-serverAll versions (No fix recorded)
airbyte-server-fipsAll versions (No fix recorded)
akhq< 0.28.0-r5
apache-hop< 2.19.0-r0
apache-hop-fips< 2.19.0-r0
apache-nifi-2.11< 2.11.0-r5
apache-nifi-registry-2.11< 2.11.0-r2
apache-polaris< 1.7.0-r1
apache-polaris-fips< 1.7.0-r1
apicurio-registry< 3.3.1-r6
apicurio-registry-fips< 3.3.1-r5
camunda-8.8< 8.8.35-r1
camunda-zeebe-8.6< 8.6.39-r9
camunda-zeebe-8.7< 8.7.37-r1
camunda-zeebe-8.8< 8.8.35-r1
cassandra-reaper< 5.0.0-r8
cloudwatch-exporter< 0.18.0-r4 | < 0.18.0-r5
commercial-elasticsearch-9.2All versions (No fix recorded)
commercial-elasticsearch-9.3All versions (No fix recorded)
commercial-elasticsearch-9.4< 9.4.6-r0
commercial-elasticsearch-9.5< 9.5.3-r0
conductor< 3.32.1-r5
conductor-fips< 3.32.1-r4
dependency-track< 4.14.3-r2
dependency-track-apiserver-4< 4.14.3-r5
dependency-track-apiserver-5< 5.0.4-r3
dependency-track-bundled< 4.14.3-r2
druid< 37.0.0-r51 | < 37.0.0-r56
elasticsearch-9.2All versions (No fix recorded)
elasticsearch-9.2-iamguarded< 9.2.8-r13
elasticsearch-9.2-iamguarded-fipsAll versions (No fix recorded)
elasticsearch-9.3< 9.3.8-r4
elasticsearch-9.3-iamguarded< 9.3.8-r4
elasticsearch-9.3-iamguarded-fips< 9.3.7-r7
elasticsearch-9.4< 9.4.5-r1
elasticsearch-9.4-iamguarded< 9.4.5-r1
elasticsearch-9.4-iamguarded-fips< 9.4.5-r4
elasticsearch-9.5< 9.5.2-r2
elasticsearch-9.5-iamguarded< 9.5.2-r2
elasticsearch-9.5-iamguarded-fips< 9.5.2-r1
elasticsearch-fips-9.2All versions (No fix recorded)
elasticsearch-fips-9.3< 9.3.7-r7
elasticsearch-fips-9.4< 9.4.5-r4
elasticsearch-fips-9.5< 9.5.2-r1
floci< 1.6.0-r3
floci-az< 0.10.0-r3
flyway< 13.7.0-r1
geoserver-3.0< 3.0.1-r2
hadoop-fips-3.3.6All versions (No fix recorded)
hadoop-fips-3.4.2All versions (No fix recorded)
hadoop-fips-3.5< 3.5.0-r3
jbang< 0.141.0-r4
jmeterAll versions (No fix recorded)
kayenta-2026.0< 2026.0.7-r2
kayenta-2026.1< 2026.1.2-r3
kayenta-fips-2026.0< 2026.0.5-r1
kayenta-fips-2026.1< 2026.1.2-r3
kserve-modelmesh< 0.12.0-r39
logstash-8.19< 8.19.20-r4
logstash-8.19-iamguarded-compat< 8.19.20-r4
logstash-8.19-with-output-opensearch< 8.19.20-r4
logstash-9.2All versions (No fix recorded)
logstash-9.2-iamguarded-compatAll versions (No fix recorded)
logstash-9.2-with-output-opensearchAll versions (No fix recorded)
logstash-9.3< 9.3.8-r2 | All versions (No fix recorded)
logstash-9.3-iamguarded-compatAll versions (No fix recorded) | < 9.3.8-r2
logstash-9.4< 9.4.5-r3
logstash-9.4-iamguarded-compat< 9.4.5-r3
logstash-9.5< 9.5.2-r3
logstash-9.5-iamguarded-compat< 9.5.2-r3
logstash-fips-9.4< 9.4.5-r3
logstash-fips-9.4-iamguarded-compat< 9.4.5-r3
logstash-fips-9.5< 9.5.2-r4
logstash-fips-9.5-iamguarded-compat< 9.5.2-r4
metabase< 0.63.15-r1
nacos< 3.2.3-r8
nacos-docker< 3.2.3-r5
nrjmx< 2.13.0-r3
nuxeo-2023< 2023.45-r8
opensearch-2-ml-commons< 2.19.6-r7
opensearch-3< 3.7.0-r14
opensearch-3-alerting< 3.7.0-r14
opensearch-3-anomaly-detection< 3.7.0-r14
opensearch-3-cross-cluster-replication< 3.7.0-r14
opensearch-3-discovery-ec2< 3.8.0-r3
opensearch-3-iamguarded-compat< 3.8.0-r3
opensearch-3-k-nn< 3.7.0-r14
opensearch-3-ml-commons< 3.7.0-r14
opensearch-3-neural-searchAll versions (No fix recorded)
opensearch-3-notifications< 3.7.0-r14
opensearch-3-security< 3.7.0-r14
opensearch-3-sql< 3.7.0-r14
opensearch-fips-3< 3.8.0-r1
opensearch-fips-3-alerting< 3.8.0-r1
opensearch-fips-3-anomaly-detection< 3.8.0-r1
opensearch-fips-3-cross-cluster-replication< 3.8.0-r1
opensearch-fips-3-index-management< 3.8.0-r1
opensearch-fips-3-k-nn< 3.8.0-r1
opensearch-fips-3-ml-commons< 3.8.0-r1
opensearch-fips-3-notifications< 3.8.0-r1
opensearch-fips-3-security< 3.8.0-r1
opensearch-fips-3-sql< 3.8.0-r1
pinot< 1.5.1-r14
pinot-fips< 1.5.1-r10
reposilite< 3.6.2-r4
s3proxy< 4.0.0-r1
s3proxy-fips< 4.0.0-r1
sonarqube< 26.9.0.129388-r4 | < 26.8.0.126808-r1
thingsboard-tb-mqtt-transport< 4.3.1.3-r19
thingsboard-tb-node< 4.3.1.3-r19
traccar< 6.14.5-r6
traccar-fips< 6.14.5-r7
trino-plugin-clickhouseAll versions (No fix recorded) | < 483-r5
trino-plugin-delta-lake< 483-r5
trino-plugin-druid< 483-r5
trino-plugin-elasticsearch< 483-r5
trino-plugin-exchange-filesystem< 483-r5
trino-plugin-exchange-hdfs< 483-r5
trino-plugin-hive< 483-r5
trino-plugin-hudi< 483-r5
trino-plugin-iceberg< 483-r5
trino-plugin-kafka< 483-r5
trino-plugin-lakehouse< 483-r5
trino-plugin-openlineage< 483-r5
trino-plugin-opensearch< 483-r5
trino-plugin-pinot< 483-r5
trino-plugin-redshift< 483-r5
trino-plugin-spooling-filesystem< 483-r5
wavefront-proxy< 13.9-r30
wazuh-indexer-plugin-ml-commons< 4.14.7-r4
wso2is< 7.3.0-r3
zaproxyAll versions (No fix recorded)
zipkin< 3.6.1-r27
zipkin-slim< 3.6.1-r27

Show all 146

Wolfi48 products

akhq< 0.28.0-r5
apicurio-registry< 3.3.1-r6
cassandra-reaper< 5.0.0-r8
cloudwatch-exporter< 0.18.0-r4 | < 0.18.0-r5
dependency-track< 4.14.3-r2

Show all 48

Debian2 products

commons-httpclientAll versions (No fix recorded)
httpcomponents-clientAll versions (No fix recorded)

Ubuntu2 products

commons-httpclientAll versions (No fix recorded)
httpcomponents-clientAll versions (No fix recorded)

Apache1 product

httpclient≥ 5.0.0, < 5.6.3

Apache software foundation1 product

apache httpcomponents client≥ 5.0-alpha, ≤ 5.6.2

6 vendors · 200 products · Showing 200 of 204. Use Open JSON for the complete list.

References

16 links

lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511qVendor AdvisoryREPORTAdvisoryWEBMailing ListRelease Notes
www.openwall.com/lists/oss-security/2026/08/13/5WEB
www.suse.com/support/update/announcement/2026/suse-su-20264028-1/Advisory
bugzilla.suse.com/1273163REPORT
www.suse.com/security/cve/CVE-2026-64607WEB
ubuntu.com/security/CVE-2026-64607REPORT
www.cve.org/CVERecord?id=CVE-2026-64607REPORT
security-tracker.debian.org/tracker/CVE-2026-64607Advisory
repo.maven.apache.org/maven2/WEB
github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64607.jsonAdvisory

Show all 16 references

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities