Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2026-64607 →
DEBIAN-CVE-2026-64607
HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an inva...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. Please note this defect does not affect HttpClient based on the async i/o model. This issue affects Apache HttpComponents Client: from 5.0-alpha1 through 5.6.2.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Debian:12
commons-httpclient
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:13
commons-httpclient
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:14
commons-httpclient
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:12
httpcomponents-client
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:13
httpcomponents-client
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:14
httpcomponents-client
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Références
- advisory security-tracker.debian.org