RHLW-2026-8118b2499151de91

See a problem?
Please try reporting it to the source first.
Source
https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-8118b2499151de91.json
Import Source
https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-8118b2499151de91.json
JSON Data
https://api.test.osv.dev/v1/vulns/RHLW-2026-8118b2499151de91
Upstream
Published
2026-10-12T16:58:46Z
Modified
2026-10-22T00:08:36Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
Summary
Lightwell Security Advisory: httpclient5 5.6.1.rhlw-00012
Details

Red Hat Lightwell has released org.apache.httpcomponents.client5:httpclient5 5.6.1.rhlw-00012 with a backported security fix.

CVE-2026-64607: Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS

This patched artifact is a drop-in replacement for org.apache.httpcomponents.client5:httpclient5 5.6.1 from Maven Central.

References
Credits
    • Red Hat Lightwell - REMEDIATION_DEVELOPER

Affected packages

Red Hat Lightwell:Maven / org.apache.httpcomponents.client5:httpclient5

Package

Name
org.apache.httpcomponents.client5:httpclient5
Purl
pkg:maven/org.apache.httpcomponents.client5/httpclient5

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
5.6.1.rhlw-00012

Affected versions

5.*
5.0-alpha1
5.0-alpha2
5.0-alpha3
5.0-beta1
5.0-beta2
5.0-beta3
5.0-beta4
5.0-beta5
5.0-beta6
5.0-beta7
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.1-beta1
5.1
5.1.1
5.1.2
5.1.3
5.1.4
5.2-alpha1
5.2-beta1
5.2
5.2.1
5.2.2
5.2.3
5.3-alpha1
5.3
5.3.1
5.4-alpha1
5.4-alpha2
5.4-beta1
5.4
5.4.1
5.4.2
5.4.3
5.4.4
5.5-alpha1
5.5
5.5.1
5.5.2
5.6-alpha1
5.6
5.6.1

Database specific

lightwell 
{
    "backport_base_version": "5.6.1",
    "remediated_version": "5.6.1.rhlw-00012",
    "repository_url": "https://packages.redhat.com/lightwell/java/remediated/"
}
source 
"https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-8118b2499151de91.json"