GHSA-hjcp-jmpx-g3qm

Suggest an improvement
Source
https://github.com/advisories/GHSA-hjcp-jmpx-g3qm
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-hjcp-jmpx-g3qm/GHSA-hjcp-jmpx-g3qm.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-hjcp-jmpx-g3qm
Aliases
Downstream
CGA (357)
MINI (22)
Published
2026-07-31T12:30:30Z
Modified
2026-08-13T21:11:16Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
Summary
Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS
Details

HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. Please note this defect does not affect HttpClient based on the async i/o model.

This issue affects Apache HttpComponents Client: from 5.0-alpha1 through 5.6.2.

Database specific 
{
    "cwe_ids": [
        "CWE-772"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-13T18:40:18Z",
    "nvd_published_at": "2026-07-31T11:17:11Z",
    "severity": "MODERATE"
}
References

Affected packages

Maven / org.apache.httpcomponents.client5:httpclient5

Package

Name
org.apache.httpcomponents.client5:httpclient5
View open source insights on deps.dev
Purl
pkg:maven/org.apache.httpcomponents.client5/httpclient5

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.0-alpha1
Fixed
5.6.3

Affected versions

5.*
5.0-alpha1
5.0-alpha2
5.0-alpha3
5.0-beta1
5.0-beta2
5.0-beta3
5.0-beta4
5.0-beta5
5.0-beta6
5.0-beta7
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.1-beta1
5.1
5.1.1
5.1.2
5.1.3
5.1.4
5.2-alpha1
5.2-beta1
5.2
5.2.1
5.2.2
5.2.3
5.3-alpha1
5.3
5.3.1
5.4-alpha1
5.4-alpha2
5.4-beta1
5.4
5.4.1
5.4.2
5.4.3
5.4.4
5.5-alpha1
5.5
5.5.1
5.5.2
5.6-alpha1
5.6
5.6.1
5.6.2

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-hjcp-jmpx-g3qm/GHSA-hjcp-jmpx-g3qm.json"