This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page.
View CVE-2026-64607 →
DEBIAN-CVE-2026-64607
HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an inva...
Original description
The description as published by the source.
HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. Please note this defect does not affect HttpClient based on the async i/o model. This issue affects Apache HttpComponents Client: from 5.0-alpha1 through 5.6.2.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Debian:12
commons-httpclient
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:13
commons-httpclient
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:14
commons-httpclient
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:12
httpcomponents-client
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:13
httpcomponents-client
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:14
httpcomponents-client
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
References
- advisory security-tracker.debian.org