{"action":"Upgrade org.apache.httpcomponents.client5:httpclient5 to 5.6.3 or later.","affected":[{"fixed":"5.6.3","introduced":"5.0-alpha1"}],"component":"org.apache.httpcomponents.client5:httpclient5","cve_ids":["CVE-2026-64607"],"ecosystem":"Maven","epss":0.00464,"exploited":false,"fixed_versions":["5.6.3"],"ghsa_id":"GHSA-hjcp-jmpx-g3qm","id":"tcs_01M5N90VPXFEVE6MFCKNXJDQ4E","modified_at":"2026-09-10T03:50:12.358752934Z","published_at":"2026-07-31T12:30:30Z","references":["https://osv.dev/vulnerability/GHSA-hjcp-jmpx-g3qm","https://nvd.nist.gov/vuln/detail/CVE-2026-64607","https://github.com/apache/httpcomponents-client/commit/55733f4121f7ba26ddf04fe12739d9c15962cb94","https://github.com/apache/httpcomponents-client/commit/ebac9512f555c4a355cad3f59ef2db69b597cc97","https://github.com/apache/httpcomponents-client","https://github.com/apache/httpcomponents-client/releases/tag/rel/v5.6.3","https://github.com/apache/httpcomponents-client/releases/tag/rel/v5.7-alpha1","https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q","http://www.openwall.com/lists/oss-security/2026/08/13/5"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-hjcp-jmpx-g3qm","url":"https://osv.dev/vulnerability/GHSA-hjcp-jmpx-g3qm"}],"summary":"Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS"}