Description
HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-Encoding` header value in the response message. Please note this defect does not affect HttpClient based on the async i/o model.
This issue affects Apache HttpComponents Client: from 5.0-alpha1 through 5.6.2.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache HttpComponents Client | 5.0-alpha – ≤ 5.6.2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | commons-httpclient +1 | No fix yet | — |
| Debian 13 | commons-httpclient +1 | No fix yet | — |
| Debian 12 | commons-httpclient +1 | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | commons-httpclient +1 | No fix yet | — |
| Ubuntu 26.04 LTS | commons-httpclient +1 | No fix yet | — |
| Ubuntu 24.04 LTS | commons-httpclient +1 | No fix yet | — |
| Ubuntu 22.04 LTS | commons-httpclient +1 | No fix yet | — |
| Ubuntu 20.04 LTS | commons-httpclient | No fix yet | — |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | commons-httpclient | No fix yet | — |
| Ubuntu 16.04 LTS | commons-httpclient | No fix yet | — |
| Ubuntu 14.04 LTS | commons-httpclient | No fix yet | — |
| Ubuntu Pro 20.04 LTS | httpcomponents-client | No fix yet | — |
| Ubuntu Pro 18.04 LTS | httpcomponents-client | No fix yet | — |
| Ubuntu Pro 16.04 LTS | httpcomponents-client | No fix yet | — |
| Ubuntu Pro 14.04 LTS | httpcomponents-client | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | httpcomponents-client | 4.5.14-150200.3.12.1 | SUSE-SU-2026:4028-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | httpcomponents-client | 4.5.14-2.1 | openSUSE-SU-2026:11647-1 |
| openSUSE Leap 16.0 | httpcomponents-client | 4.5.14-160000.4.1 | openSUSE-SU-2026:21894-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | akhq | 0.28.0-r5 | — |
| Wolfi rolling | apicurio-registry | 3.3.1-r6 | — |
| Wolfi rolling | cassandra-reaper | 5.0.0-r8 | — |
| Wolfi rolling | cloudwatch-exporter | 0.18.0-r4 | — |
| Wolfi rolling | dependency-track +1 | 4.14.3-r2 | — |
| Wolfi rolling | druid | 37.0.0-r51 | — |
| Wolfi rolling | flyway | 13.7.0-r1 | — |
| Wolfi rolling | kserve-modelmesh | 0.12.0-r39 | — |
| Wolfi rolling | logstash-9.3 +1 | 9.3.8-r2 | — |
| Wolfi rolling | logstash-9.4 +1 | 9.4.5-r3 | — |
| Wolfi rolling | nrjmx | 2.13.0-r3 | — |
| Wolfi rolling | opensearch-3 +8 | 3.7.0-r14 | — |
| Wolfi rolling | opensearch-3-discovery-ec2 +2 | 3.8.0-r3 | — |
| Wolfi rolling | sonarqube | 26.8.0.126808-r1 | — |
| Wolfi rolling | thingsboard-tb-node +1 | 4.3.1.3-r19 | — |
| Wolfi rolling | trino-plugin-hive +15 | 483-r5 | — |
| Wolfi rolling | wavefront-proxy | 13.9-r30 | — |
| Wolfi rolling | zipkin +1 | 3.6.1-r27 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.httpcomponents.client5:httpclient5 | >= 5.0-alpha1, < 5.6.3 | 5.6.3 | GHSA-hjcp-jmpx-g3qm |
Advisories 9
- WID-SEC-2026-2615 Apache HttpComponents: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Oct 29, 2026
- WID-SEC-2026-2867 RealObjects PDFreactor: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff BSI CERT-Bund (WID) · Oct 29, 2026
- NCSC-2026-0448 Kwetsbaarheden verholpen in Oracle Fusion Middleware NCSC-NL (Netherlands) · Oct 22, 2026
- WID-SEC-2026-4078 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 20, 2026
- WID-SEC-2026-4062 Oracle Utilities Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 20, 2026
- openSUSE-SU-2026:21894-1 Security update for httpcomponents-client SUSE / openSUSE Security Updates · Sep 25, 2026
- WID-SEC-2026-3379 Camunda: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Sep 15, 2026
- SUSE-SU-2026:4028-1 Security update for httpcomponents-client SUSE / openSUSE Security Updates · Sep 13, 2026
- openSUSE-SU-2026:11647-1 httpcomponents-client-4.5.14-2.1 on GA media SUSE / openSUSE Security Updates · Aug 31, 2026
References
- https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q vendor-advisory