Vulnerability in Apache Software Foundation Apache HttpComponents Client

[ Description ]Official description

HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-Encoding` header value in the response message. Please note this defect does not affect HttpClient based on the async i/o model. This issue affects Apache HttpComponents Client: from 5.0-alpha1 through 5.6.2.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• NCSC-NL22 Oct 2026NCSC-2026-0448

  Vulnerabilities fixed in Oracle Fusion Middleware Translated from Dutch

  Probability/damage H/HCVE-2026-54513CVE-2026-56741CVE-2026-59649+191 more CVEs
• BSI CERT-Bund20 Oct 2026WID-SEC-2026-4078

  Oracle Fusion Middleware: Multiple vulnerabilities Translated from German

  CVE-2026-91212CVE-2023-43622CVE-2026-42779+191 more CVEs
• BSI CERT-Bund20 Oct 2026WID-SEC-2026-4062

  Oracle Utilities Applications: Multiple vulnerabilities Translated from German

  CVE-2026-49844CVE-2026-41239CVE-2026-68497+5 more CVEs

[ References ]References

• lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511qvendor-advisory