RHLW-2026-32de0f514c232ff5

See a problem?
Please try reporting it to the source first.
Source
https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-32de0f514c232ff5.json
Import Source
https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-32de0f514c232ff5.json
JSON Data
https://api.test.osv.dev/v1/vulns/RHLW-2026-32de0f514c232ff5
Upstream
CVE (2)
GHSA (1)
Published
2026-10-08T00:00:00Z
Modified
2026-10-22T00:08:22Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
Summary
Lightwell Security Advisory: httpclient5 5.6.2.rhlw-00005
Details

Red Hat Lightwell has released org.apache.httpcomponents.client5:httpclient5 5.6.2.rhlw-00005 with backported fixes for CVE-2026-64607 and CVE-2026-71290.

CVE-2026-64607: Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS

CVE-2026-71290: Apache HttpComponents Client: TLS hostname verification silently disabled on the async transport (default config, MITM)

This patched artifact is a drop-in replacement for org.apache.httpcomponents.client5:httpclient5 5.6.2 from Maven Central.

References
Credits
    • Red Hat Lightwell - REMEDIATION_DEVELOPER

Affected packages

Red Hat Lightwell:Maven / org.apache.httpcomponents.client5:httpclient5

Package

Name
org.apache.httpcomponents.client5:httpclient5
Purl
pkg:maven/org.apache.httpcomponents.client5/httpclient5

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
5.6.2.rhlw-00005

Affected versions

5.*
5.0-alpha1
5.0-alpha2
5.0-alpha3
5.0-beta1
5.0-beta2
5.0-beta3
5.0-beta4
5.0-beta5
5.0-beta6
5.0-beta7
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.1-beta1
5.1
5.1.1
5.1.2
5.1.3
5.1.4
5.2-alpha1
5.2-beta1
5.2
5.2.1
5.2.2
5.2.3
5.3-alpha1
5.3
5.3.1
5.4-alpha1
5.4-alpha2
5.4-beta1
5.4
5.4.1
5.4.2
5.4.3
5.4.4
5.5-alpha1
5.5
5.5.1
5.5.2
5.6-alpha1
5.6
5.6.1
5.6.2

Database specific

lightwell 
{
    "backport_base_version": "5.6.2",
    "remediated_version": "5.6.2.rhlw-00005",
    "repository_url": "https://packages.redhat.com/lightwell/java/remediated/"
}
source 
"https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-32de0f514c232ff5.json"