{"document":{"aggregate_severity":{"namespace":"https://access.redhat.com/security/updates/classification/","text":"Important"},"category":"csaf_vex","csaf_version":"2.0","distribution":{"text":"Copyright © Red Hat, Inc. All rights reserved.","tlp":{"label":"WHITE","url":"https://www.first.org/tlp/"}},"lang":"en","notes":[{"category":"legal_disclaimer","text":"This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.","title":"Terms of Use"}],"publisher":{"category":"vendor","contact_details":"https://access.redhat.com/security/team/contact/","issuing_authority":"Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.","name":"Red Hat Product Security","namespace":"https://www.redhat.com"},"references":[{"category":"self","summary":"Canonical URL","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64607.json"}],"title":"org.apache.httpcomponents/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak","tracking":{"current_release_date":"2026-09-03T18:34:39+00:00","generator":{"date":"2026-09-03T18:34:39+00:00","engine":{"name":"Red Hat SDEngine","version":"5.3.16"}},"id":"CVE-2026-64607","initial_release_date":"2026-07-31T10:12:18.035000+00:00","revision_history":[{"date":"2026-07-31T10:12:18.035000+00:00","number":"1","summary":"Initial version"},{"date":"2026-09-02T20:52:16+00:00","number":"2","summary":"Current version"},{"date":"2026-09-03T18:34:39+00:00","number":"3","summary":"Last generated version"}],"status":"final","version":"3"}},"product_tree":{"branches":[{"branches":[{"branches":[{"category":"product_name","name":"OpenShift Developer Tools and Services","product":{"name":"OpenShift Developer Tools and Services","product_id":"openshift_developer_tools_and_services","product_identification_helper":{"cpe":"cpe:/a:redhat:ocp_tools"}}}],"category":"product_family","name":"OpenShift Developer Tools and Services"},{"branches":[{"category":"product_name","name":"OpenShift Serverless","product":{"name":"OpenShift Serverless","product_id":"openshift_serverless","product_identification_helper":{"cpe":"cpe:/a:redhat:serverless:1"}}}],"category":"product_family","name":"OpenShift Serverless"},{"branches":[{"category":"product_name","name":"Red Hat build of Apache Camel 4 for Quarkus 3","product":{"name":"Red Hat build of Apache Camel 4 for Quarkus 3","product_id":"red_hat_build_of_apache_camel_4_for_quarkus_3","product_identification_helper":{"cpe":"cpe:/a:redhat:camel_quarkus:3"}}}],"category":"product_family","name":"Red Hat build of Apache Camel 4 for Quarkus 3"},{"branches":[{"category":"product_name","name":"Red Hat build of Apache Camel for Spring Boot 4","product":{"name":"Red Hat build of Apache Camel for Spring Boot 4","product_id":"red_hat_build_of_apache_camel_for_spring_boot_4","product_identification_helper":{"cpe":"cpe:/a:redhat:camel_spring_boot:4"}}}],"category":"product_family","name":"Red Hat build of Apache Camel for Spring Boot 4"},{"branches":[{"category":"product_name","name":"Red Hat build of Apicurio Registry 3","product":{"name":"Red Hat build of Apicurio Registry 3","product_id":"red_hat_build_of_apicurio_registry_3","product_identification_helper":{"cpe":"cpe:/a:redhat:apicurio_registry:3"}}}],"category":"product_family","name":"Red Hat build of Apicurio Registry 3"},{"branches":[{"category":"product_name","name":"Red Hat build of Debezium 3","product":{"name":"Red Hat build of Debezium 3","product_id":"red_hat_build_of_debezium_3","product_identification_helper":{"cpe":"cpe:/a:redhat:debezium:3"}}}],"category":"product_family","name":"Red Hat build of Debezium 3"},{"branches":[{"category":"product_name","name":"Red Hat build of Quarkus","product":{"name":"Red Hat build of Quarkus","product_id":"red_hat_build_of_quarkus","product_identification_helper":{"cpe":"cpe:/a:redhat:quarkus:3"}}}],"category":"product_family","name":"Red Hat build of Quarkus"},{"branches":[{"category":"product_name","name":"Red Hat Enterprise Linux 9","product":{"name":"Red Hat Enterprise Linux 9","product_id":"red_hat_enterprise_linux_9","product_identification_helper":{"cpe":"cpe:/o:redhat:enterprise_linux:9"}}}],"category":"product_family","name":"Red Hat Enterprise Linux 9"},{"branches":[{"category":"product_name","name":"Red Hat OpenShift AI (RHOAI)","product":{"name":"Red Hat OpenShift AI (RHOAI)","product_id":"red_hat_openshift_ai_(rhoai)","product_identification_helper":{"cpe":"cpe:/a:redhat:openshift_ai"}}}],"category":"product_family","name":"Red Hat OpenShift AI (RHOAI)"},{"branches":[{"category":"product_name","name":"Red Hat OpenShift Dev Spaces","product":{"name":"Red Hat OpenShift Dev Spaces","product_id":"red_hat_openshift_dev_spaces","product_identification_helper":{"cpe":"cpe:/a:redhat:openshift_devspaces:3"}}}],"category":"product_family","name":"Red Hat OpenShift Dev Spaces"},{"branches":[{"category":"product_name","name":"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP1","product":{"name":"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP1","product_id":"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP1","product_identification_helper":{"cpe":"cpe:/a:redhat:apache_camel_quarkus:3.33"}}}],"category":"product_family","name":"Red Hat Build of Apache Camel"},{"category":"product_version","name":"jenkins-2-plugins.src","product":{"name":"jenkins-2-plugins.src","product_id":"jenkins-2-plugins.src","product_identification_helper":{"purl":"pkg:rpm/redhat/jenkins-2-plugins?arch=src"}}},{"category":"product_version","name":"ocp-tools-4/jenkins-rhel8","product":{"name":"ocp-tools-4/jenkins-rhel8","product_id":"ocp-tools-4/jenkins-rhel8","product_identification_helper":{"purl":"pkg:oci/jenkins-rhel8?repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel8"}}},{"category":"product_version","name":"ocp-tools-4/jenkins-rhel9","product":{"name":"ocp-tools-4/jenkins-rhel9","product_id":"ocp-tools-4/jenkins-rhel9","product_identification_helper":{"purl":"pkg:oci/jenkins-rhel9?repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9"}}},{"category":"product_version","name":"openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9","product":{"name":"openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9","product_id":"openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9","product_identification_helper":{"purl":"pkg:oci/kn-eventing-integrations-aws-ddb-streams-source-rhel9?repository_url=registry.redhat.io/openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9"}}},{"category":"product_version","name":"openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9","product":{"name":"openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9","product_id":"openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9","product_identification_helper":{"purl":"pkg:oci/kn-eventing-integrations-aws-s3-sink-rhel9?repository_url=registry.redhat.io/openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9"}}},{"category":"product_version","name":"openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9","product":{"name":"openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9","product_id":"openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9","product_identification_helper":{"purl":"pkg:oci/kn-eventing-integrations-aws-s3-source-rhel9?repository_url=registry.redhat.io/openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9"}}},{"category":"product_version","name":"openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9","product":{"name":"openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9","product_id":"openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9","product_identification_helper":{"purl":"pkg:oci/kn-eventing-integrations-aws-sns-sink-rhel9?repository_url=registry.redhat.io/openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9"}}},{"category":"product_version","name":"openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9","product":{"name":"openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9","product_id":"openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9","product_identification_helper":{"purl":"pkg:oci/kn-eventing-integrations-aws-sqs-sink-rhel9?repository_url=registry.redhat.io/openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9"}}},{"category":"product_version","name":"openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel9","product":{"name":"openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel9","product_id":"openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel9","product_identification_helper":{"purl":"pkg:oci/kn-eventing-integrations-aws-sqs-source-rhel9?repository_url=registry.redhat.io/openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel9"}}},{"category":"product_version","name":"camel-quarkus-support-httpclient5","product":{"name":"camel-quarkus-support-httpclient5","product_id":"camel-quarkus-support-httpclient5","product_identification_helper":{"purl":"pkg:maven/org.apache.camel.quarkus/camel-quarkus-support-httpclient5"}}},{"category":"product_version","name":"camel-quarkus-support-httpclient5-deployment","product":{"name":"camel-quarkus-support-httpclient5-deployment","product_id":"camel-quarkus-support-httpclient5-deployment","product_identification_helper":{"purl":"pkg:maven/org.apache.camel.quarkus/camel-quarkus-support-httpclient5-deployment"}}},{"category":"product_version","name":"httpclient5","product":{"name":"httpclient5","product_id":"httpclient5","product_identification_helper":{"purl":"pkg:maven/org.apache.httpcomponents.client5/httpclient5"}}},{"category":"product_version","name":"httpclient5-cache","product":{"name":"httpclient5-cache","product_id":"httpclient5-cache","product_identification_helper":{"purl":"pkg:maven/org.apache.httpcomponents.client5/httpclient5-cache"}}},{"category":"product_version","name":"quarkus-apache-httpclient","product":{"name":"quarkus-apache-httpclient","product_id":"quarkus-apache-httpclient","product_identification_helper":{"purl":"pkg:maven/io.quarkus/quarkus-apache-httpclient"}}},{"category":"product_version","name":"httpclient5-parent","product":{"name":"httpclient5-parent","product_id":"httpclient5-parent","product_identification_helper":{"purl":"pkg:maven/org.apache.httpcomponents.client5/httpclient5-parent"}}},{"category":"product_version","name":"jmc","product":{"name":"jmc","product_id":"jmc","product_identification_helper":{"purl":"pkg:rpm/redhat/jmc"}}},{"category":"product_version","name":"jmc.src","product":{"name":"jmc.src","product_id":"jmc.src","product_identification_helper":{"purl":"pkg:rpm/redhat/jmc?arch=src"}}},{"category":"product_version","name":"rhoai/odh-modelmesh-rhel9","product":{"name":"rhoai/odh-modelmesh-rhel9","product_id":"rhoai/odh-modelmesh-rhel9","product_identification_helper":{"purl":"pkg:oci/odh-modelmesh-rhel9?repository_url=registry.redhat.io/rhoai/odh-modelmesh-rhel9"}}},{"category":"product_version","name":"devspaces/jetbrains-ide-rhel9","product":{"name":"devspaces/jetbrains-ide-rhel9","product_id":"devspaces/jetbrains-ide-rhel9","product_identification_helper":{"purl":"pkg:oci/jetbrains-ide-rhel9?repository_url=registry.redhat.io/devspaces/jetbrains-ide-rhel9"}}},{"category":"product_version","name":"devspaces/openvsx-rhel9","product":{"name":"devspaces/openvsx-rhel9","product_id":"devspaces/openvsx-rhel9","product_identification_helper":{"purl":"pkg:oci/openvsx-rhel9?repository_url=registry.redhat.io/devspaces/openvsx-rhel9"}}},{"category":"product_version","name":"devspaces/pluginregistry-rhel9","product":{"name":"devspaces/pluginregistry-rhel9","product_id":"devspaces/pluginregistry-rhel9","product_identification_helper":{"purl":"pkg:oci/pluginregistry-rhel9?repository_url=registry.redhat.io/devspaces/pluginregistry-rhel9"}}}],"category":"vendor","name":"Red Hat"}],"relationships":[{"category":"default_component_of","full_product_name":{"name":"jenkins-2-plugins.src as a component of OpenShift Developer Tools and Services","product_id":"openshift_developer_tools_and_services:jenkins-2-plugins.src"},"product_reference":"jenkins-2-plugins.src","relates_to_product_reference":"openshift_developer_tools_and_services"},{"category":"default_component_of","full_product_name":{"name":"ocp-tools-4/jenkins-rhel8 as a component of OpenShift Developer Tools and Services","product_id":"openshift_developer_tools_and_services:ocp-tools-4/jenkins-rhel8"},"product_reference":"ocp-tools-4/jenkins-rhel8","relates_to_product_reference":"openshift_developer_tools_and_services"},{"category":"default_component_of","full_product_name":{"name":"ocp-tools-4/jenkins-rhel9 as a component of OpenShift Developer Tools and Services","product_id":"openshift_developer_tools_and_services:ocp-tools-4/jenkins-rhel9"},"product_reference":"ocp-tools-4/jenkins-rhel9","relates_to_product_reference":"openshift_developer_tools_and_services"},{"category":"default_component_of","full_product_name":{"name":"openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9 as a component of OpenShift Serverless","product_id":"openshift_serverless:openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9"},"product_reference":"openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9","relates_to_product_reference":"openshift_serverless"},{"category":"default_component_of","full_product_name":{"name":"openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9 as a component of OpenShift Serverless","product_id":"openshift_serverless:openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9"},"product_reference":"openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9","relates_to_product_reference":"openshift_serverless"},{"category":"default_component_of","full_product_name":{"name":"openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9 as a component of OpenShift Serverless","product_id":"openshift_serverless:openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9"},"product_reference":"openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9","relates_to_product_reference":"openshift_serverless"},{"category":"default_component_of","full_product_name":{"name":"openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9 as a component of OpenShift Serverless","product_id":"openshift_serverless:openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9"},"product_reference":"openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9","relates_to_product_reference":"openshift_serverless"},{"category":"default_component_of","full_product_name":{"name":"openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9 as a component of OpenShift Serverless","product_id":"openshift_serverless:openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9"},"product_reference":"openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9","relates_to_product_reference":"openshift_serverless"},{"category":"default_component_of","full_product_name":{"name":"openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel9 as a component of OpenShift Serverless","product_id":"openshift_serverless:openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel9"},"product_reference":"openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel9","relates_to_product_reference":"openshift_serverless"},{"category":"default_component_of","full_product_name":{"name":"camel-quarkus-support-httpclient5 as a component of Red Hat build of Apache Camel 4 for Quarkus 3","product_id":"red_hat_build_of_apache_camel_4_for_quarkus_3:camel-quarkus-support-httpclient5"},"product_reference":"camel-quarkus-support-httpclient5","relates_to_product_reference":"red_hat_build_of_apache_camel_4_for_quarkus_3"},{"category":"default_component_of","full_product_name":{"name":"camel-quarkus-support-httpclient5-deployment as a component of Red Hat build of Apache Camel 4 for Quarkus 3","product_id":"red_hat_build_of_apache_camel_4_for_quarkus_3:camel-quarkus-support-httpclient5-deployment"},"product_reference":"camel-quarkus-support-httpclient5-deployment","relates_to_product_reference":"red_hat_build_of_apache_camel_4_for_quarkus_3"},{"category":"default_component_of","full_product_name":{"name":"httpclient5 as a component of Red Hat build of Apache Camel 4 for Quarkus 3","product_id":"red_hat_build_of_apache_camel_4_for_quarkus_3:httpclient5"},"product_reference":"httpclient5","relates_to_product_reference":"red_hat_build_of_apache_camel_4_for_quarkus_3"},{"category":"default_component_of","full_product_name":{"name":"httpclient5-cache as a component of Red Hat build of Apache Camel 4 for Quarkus 3","product_id":"red_hat_build_of_apache_camel_4_for_quarkus_3:httpclient5-cache"},"product_reference":"httpclient5-cache","relates_to_product_reference":"red_hat_build_of_apache_camel_4_for_quarkus_3"},{"category":"default_component_of","full_product_name":{"name":"quarkus-apache-httpclient as a component of Red Hat build of Apache Camel 4 for Quarkus 3","product_id":"red_hat_build_of_apache_camel_4_for_quarkus_3:quarkus-apache-httpclient"},"product_reference":"quarkus-apache-httpclient","relates_to_product_reference":"red_hat_build_of_apache_camel_4_for_quarkus_3"},{"category":"default_component_of","full_product_name":{"name":"httpclient5 as a component of Red Hat build of Apache Camel for Spring Boot 4","product_id":"red_hat_build_of_apache_camel_for_spring_boot_4:httpclient5"},"product_reference":"httpclient5","relates_to_product_reference":"red_hat_build_of_apache_camel_for_spring_boot_4"},{"category":"default_component_of","full_product_name":{"name":"httpclient5-cache as a component of Red Hat build of Apache Camel for Spring Boot 4","product_id":"red_hat_build_of_apache_camel_for_spring_boot_4:httpclient5-cache"},"product_reference":"httpclient5-cache","relates_to_product_reference":"red_hat_build_of_apache_camel_for_spring_boot_4"},{"category":"default_component_of","full_product_name":{"name":"httpclient5-parent as a component of Red Hat build of Apache Camel for Spring Boot 4","product_id":"red_hat_build_of_apache_camel_for_spring_boot_4:httpclient5-parent"},"product_reference":"httpclient5-parent","relates_to_product_reference":"red_hat_build_of_apache_camel_for_spring_boot_4"},{"category":"default_component_of","full_product_name":{"name":"httpclient5 as a component of Red Hat build of Apicurio Registry 3","product_id":"red_hat_build_of_apicurio_registry_3:httpclient5"},"product_reference":"httpclient5","relates_to_product_reference":"red_hat_build_of_apicurio_registry_3"},{"category":"default_component_of","full_product_name":{"name":"quarkus-apache-httpclient as a component of Red Hat build of Apicurio Registry 3","product_id":"red_hat_build_of_apicurio_registry_3:quarkus-apache-httpclient"},"product_reference":"quarkus-apache-httpclient","relates_to_product_reference":"red_hat_build_of_apicurio_registry_3"},{"category":"default_component_of","full_product_name":{"name":"httpclient5 as a component of Red Hat build of Debezium 3","product_id":"red_hat_build_of_debezium_3:httpclient5"},"product_reference":"httpclient5","relates_to_product_reference":"red_hat_build_of_debezium_3"},{"category":"default_component_of","full_product_name":{"name":"quarkus-apache-httpclient as a component of Red Hat build of Quarkus","product_id":"red_hat_build_of_quarkus:quarkus-apache-httpclient"},"product_reference":"quarkus-apache-httpclient","relates_to_product_reference":"red_hat_build_of_quarkus"},{"category":"default_component_of","full_product_name":{"name":"jmc as a component of Red Hat Enterprise Linux 9","product_id":"red_hat_enterprise_linux_9:jmc"},"product_reference":"jmc","relates_to_product_reference":"red_hat_enterprise_linux_9"},{"category":"default_component_of","full_product_name":{"name":"jmc.src as a component of Red Hat Enterprise Linux 9","product_id":"red_hat_enterprise_linux_9:jmc.src"},"product_reference":"jmc.src","relates_to_product_reference":"red_hat_enterprise_linux_9"},{"category":"default_component_of","full_product_name":{"name":"rhoai/odh-modelmesh-rhel9 as a component of Red Hat OpenShift AI (RHOAI)","product_id":"red_hat_openshift_ai_(rhoai):rhoai/odh-modelmesh-rhel9"},"product_reference":"rhoai/odh-modelmesh-rhel9","relates_to_product_reference":"red_hat_openshift_ai_(rhoai)"},{"category":"default_component_of","full_product_name":{"name":"devspaces/jetbrains-ide-rhel9 as a component of Red Hat OpenShift Dev Spaces","product_id":"red_hat_openshift_dev_spaces:devspaces/jetbrains-ide-rhel9"},"product_reference":"devspaces/jetbrains-ide-rhel9","relates_to_product_reference":"red_hat_openshift_dev_spaces"},{"category":"default_component_of","full_product_name":{"name":"devspaces/openvsx-rhel9 as a component of Red Hat OpenShift Dev Spaces","product_id":"red_hat_openshift_dev_spaces:devspaces/openvsx-rhel9"},"product_reference":"devspaces/openvsx-rhel9","relates_to_product_reference":"red_hat_openshift_dev_spaces"},{"category":"default_component_of","full_product_name":{"name":"devspaces/pluginregistry-rhel9 as a component of Red Hat OpenShift Dev Spaces","product_id":"red_hat_openshift_dev_spaces:devspaces/pluginregistry-rhel9"},"product_reference":"devspaces/pluginregistry-rhel9","relates_to_product_reference":"red_hat_openshift_dev_spaces"}]},"vulnerabilities":[{"cve":"CVE-2026-64607","cwe":{"id":"CWE-772","name":"Missing Release of Resource after Effective Lifetime"},"discovery_date":"2026-07-31T11:00:52.326465+00:00","flags":[{"label":"vulnerable_code_not_present","product_ids":["red_hat_openshift_ai_(rhoai):rhoai/odh-modelmesh-rhel9","red_hat_openshift_dev_spaces:devspaces/jetbrains-ide-rhel9"]}],"ids":[{"system_name":"Red Hat Bugzilla ID","text":"2509736"}],"notes":[{"category":"description","text":"A flaw was found in Apache HttpComponents Client, specifically in its classic input/output (I/O) model. When processing a response message with an invalid or unsupported `Content-Encoding` header, the client fails to properly release the underlying network connection. This connection leak can lead to the exhaustion of the connection pool, making the service unavailable and resulting in a Denial of Service (DoS) for legitimate users.","title":"Vulnerability description"},{"category":"summary","text":"org.apache.httpcomponents/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak","title":"Vulnerability summary"},{"category":"other","text":"This is an Important flaw in Apache HttpComponents Client's classic I/O model, where an invalid `Content-Encoding` header in a response can prevent proper connection release. This connection leak can exhaust the connection pool, leading to a denial of service for applications utilizing the affected client. The vulnerability does not impact the asynchronous I/O model.","title":"Statement"},{"category":"general","text":"The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.","title":"CVSS score applicability"}],"product_status":{"fixed":["Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP1"],"known_affected":["openshift_developer_tools_and_services:jenkins-2-plugins.src","openshift_developer_tools_and_services:ocp-tools-4/jenkins-rhel8","openshift_developer_tools_and_services:ocp-tools-4/jenkins-rhel9","openshift_serverless:openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9","openshift_serverless:openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9","openshift_serverless:openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9","openshift_serverless:openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9","openshift_serverless:openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9","openshift_serverless:openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel9","red_hat_build_of_apache_camel_4_for_quarkus_3:camel-quarkus-support-httpclient5","red_hat_build_of_apache_camel_4_for_quarkus_3:camel-quarkus-support-httpclient5-deployment","red_hat_build_of_apache_camel_4_for_quarkus_3:httpclient5","red_hat_build_of_apache_camel_4_for_quarkus_3:httpclient5-cache","red_hat_build_of_apache_camel_4_for_quarkus_3:quarkus-apache-httpclient","red_hat_build_of_apache_camel_for_spring_boot_4:httpclient5","red_hat_build_of_apache_camel_for_spring_boot_4:httpclient5-cache","red_hat_build_of_apache_camel_for_spring_boot_4:httpclient5-parent","red_hat_build_of_apicurio_registry_3:httpclient5","red_hat_build_of_apicurio_registry_3:quarkus-apache-httpclient","red_hat_build_of_debezium_3:httpclient5","red_hat_build_of_quarkus:quarkus-apache-httpclient","red_hat_enterprise_linux_9:jmc","red_hat_enterprise_linux_9:jmc.src","red_hat_openshift_dev_spaces:devspaces/openvsx-rhel9","red_hat_openshift_dev_spaces:devspaces/pluginregistry-rhel9"],"known_not_affected":["red_hat_openshift_ai_(rhoai):rhoai/odh-modelmesh-rhel9","red_hat_openshift_dev_spaces:devspaces/jetbrains-ide-rhel9"]},"references":[{"category":"self","summary":"Canonical URL","url":"https://access.redhat.com/security/cve/CVE-2026-64607"},{"category":"external","summary":"RHBZ#2509736","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2509736"},{"category":"external","summary":"https://www.cve.org/CVERecord?id=CVE-2026-64607","url":"https://www.cve.org/CVERecord?id=CVE-2026-64607"},{"category":"external","summary":"https://nvd.nist.gov/vuln/detail/CVE-2026-64607","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64607"},{"category":"external","summary":"https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q","url":"https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q"}],"release_date":"2026-07-31T10:12:18.035000+00:00","remediations":[{"category":"vendor_fix","date":"2026-09-03T18:34:09+00:00","details":"Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\nThe References section of this erratum contains a download link (you must log in to download the update).","product_ids":["Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP1"],"url":"https://access.redhat.com/errata/RHSA-2026:63302"},{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.","product_ids":["Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP1","openshift_developer_tools_and_services:jenkins-2-plugins.src","openshift_developer_tools_and_services:ocp-tools-4/jenkins-rhel8","openshift_developer_tools_and_services:ocp-tools-4/jenkins-rhel9","openshift_serverless:openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9","openshift_serverless:openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9","openshift_serverless:openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9","openshift_serverless:openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9","openshift_serverless:openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9","openshift_serverless:openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel9","red_hat_build_of_apache_camel_4_for_quarkus_3:camel-quarkus-support-httpclient5","red_hat_build_of_apache_camel_4_for_quarkus_3:camel-quarkus-support-httpclient5-deployment","red_hat_build_of_apache_camel_4_for_quarkus_3:httpclient5","red_hat_build_of_apache_camel_4_for_quarkus_3:httpclient5-cache","red_hat_build_of_apache_camel_4_for_quarkus_3:quarkus-apache-httpclient","red_hat_build_of_apache_camel_for_spring_boot_4:httpclient5","red_hat_build_of_apache_camel_for_spring_boot_4:httpclient5-cache","red_hat_build_of_apache_camel_for_spring_boot_4:httpclient5-parent","red_hat_build_of_apicurio_registry_3:httpclient5","red_hat_build_of_apicurio_registry_3:quarkus-apache-httpclient","red_hat_build_of_debezium_3:httpclient5","red_hat_build_of_quarkus:quarkus-apache-httpclient","red_hat_enterprise_linux_9:jmc","red_hat_enterprise_linux_9:jmc.src","red_hat_openshift_dev_spaces:devspaces/openvsx-rhel9","red_hat_openshift_dev_spaces:devspaces/pluginregistry-rhel9"]},{"category":"none_available","details":"Affected","product_ids":["openshift_developer_tools_and_services:jenkins-2-plugins.src","openshift_developer_tools_and_services:ocp-tools-4/jenkins-rhel8","openshift_developer_tools_and_services:ocp-tools-4/jenkins-rhel9","openshift_serverless:openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9","openshift_serverless:openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9","openshift_serverless:openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9","openshift_serverless:openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9","openshift_serverless:openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9","openshift_serverless:openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel9","red_hat_build_of_apache_camel_4_for_quarkus_3:camel-quarkus-support-httpclient5","red_hat_build_of_apache_camel_4_for_quarkus_3:camel-quarkus-support-httpclient5-deployment","red_hat_build_of_apache_camel_4_for_quarkus_3:httpclient5","red_hat_build_of_apache_camel_4_for_quarkus_3:httpclient5-cache","red_hat_build_of_apache_camel_4_for_quarkus_3:quarkus-apache-httpclient","red_hat_build_of_apache_camel_for_spring_boot_4:httpclient5","red_hat_build_of_apache_camel_for_spring_boot_4:httpclient5-cache","red_hat_build_of_apache_camel_for_spring_boot_4:httpclient5-parent","red_hat_build_of_apicurio_registry_3:httpclient5","red_hat_build_of_apicurio_registry_3:quarkus-apache-httpclient","red_hat_build_of_debezium_3:httpclient5","red_hat_build_of_quarkus:quarkus-apache-httpclient","red_hat_enterprise_linux_9:jmc","red_hat_enterprise_linux_9:jmc.src","red_hat_openshift_dev_spaces:devspaces/openvsx-rhel9","red_hat_openshift_dev_spaces:devspaces/pluginregistry-rhel9"]}],"scores":[{"cvss_v3":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP1","openshift_developer_tools_and_services:jenkins-2-plugins.src","openshift_developer_tools_and_services:ocp-tools-4/jenkins-rhel8","openshift_developer_tools_and_services:ocp-tools-4/jenkins-rhel9","openshift_serverless:openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9","openshift_serverless:openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9","openshift_serverless:openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9","openshift_serverless:openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9","openshift_serverless:openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9","openshift_serverless:openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel9","red_hat_build_of_apache_camel_4_for_quarkus_3:camel-quarkus-support-httpclient5","red_hat_build_of_apache_camel_4_for_quarkus_3:camel-quarkus-support-httpclient5-deployment","red_hat_build_of_apache_camel_4_for_quarkus_3:httpclient5","red_hat_build_of_apache_camel_4_for_quarkus_3:httpclient5-cache","red_hat_build_of_apache_camel_4_for_quarkus_3:quarkus-apache-httpclient","red_hat_build_of_apache_camel_for_spring_boot_4:httpclient5","red_hat_build_of_apache_camel_for_spring_boot_4:httpclient5-cache","red_hat_build_of_apache_camel_for_spring_boot_4:httpclient5-parent","red_hat_build_of_apicurio_registry_3:httpclient5","red_hat_build_of_apicurio_registry_3:quarkus-apache-httpclient","red_hat_build_of_debezium_3:httpclient5","red_hat_build_of_quarkus:quarkus-apache-httpclient","red_hat_enterprise_linux_9:jmc","red_hat_enterprise_linux_9:jmc.src","red_hat_openshift_ai_(rhoai):rhoai/odh-modelmesh-rhel9","red_hat_openshift_dev_spaces:devspaces/jetbrains-ide-rhel9","red_hat_openshift_dev_spaces:devspaces/openvsx-rhel9","red_hat_openshift_dev_spaces:devspaces/pluginregistry-rhel9"]}],"threats":[{"category":"impact","details":"Important","product_ids":["Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP1","openshift_developer_tools_and_services:jenkins-2-plugins.src","openshift_developer_tools_and_services:ocp-tools-4/jenkins-rhel8","openshift_developer_tools_and_services:ocp-tools-4/jenkins-rhel9","openshift_serverless:openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9","openshift_serverless:openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9","openshift_serverless:openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9","openshift_serverless:openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9","openshift_serverless:openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9","openshift_serverless:openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel9","red_hat_build_of_apache_camel_4_for_quarkus_3:camel-quarkus-support-httpclient5","red_hat_build_of_apache_camel_4_for_quarkus_3:camel-quarkus-support-httpclient5-deployment","red_hat_build_of_apache_camel_4_for_quarkus_3:httpclient5","red_hat_build_of_apache_camel_4_for_quarkus_3:httpclient5-cache","red_hat_build_of_apache_camel_4_for_quarkus_3:quarkus-apache-httpclient","red_hat_build_of_apache_camel_for_spring_boot_4:httpclient5","red_hat_build_of_apache_camel_for_spring_boot_4:httpclient5-cache","red_hat_build_of_apache_camel_for_spring_boot_4:httpclient5-parent","red_hat_build_of_apicurio_registry_3:httpclient5","red_hat_build_of_apicurio_registry_3:quarkus-apache-httpclient","red_hat_build_of_debezium_3:httpclient5","red_hat_build_of_quarkus:quarkus-apache-httpclient","red_hat_enterprise_linux_9:jmc","red_hat_enterprise_linux_9:jmc.src","red_hat_openshift_ai_(rhoai):rhoai/odh-modelmesh-rhel9","red_hat_openshift_dev_spaces:devspaces/jetbrains-ide-rhel9","red_hat_openshift_dev_spaces:devspaces/openvsx-rhel9","red_hat_openshift_dev_spaces:devspaces/pluginregistry-rhel9"]}],"title":"org.apache.httpcomponents/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak"}]}