RHLW-2026-639f255bd180ae78

    Dashboard / Vulnerabilities / RHLW-2026-639f255bd180ae78

    RHLW-2026-639f255bd180ae78

    Published: 3 Nov 2026Last Modified: 6 Nov 2026

    Summary: Lightwell Security Advisory: httpclient5 5.6.1.rhlw-00026

    Details: Red Hat Lightwell has released org.apache.httpcomponents.client5:httpclient5 5.6.1.rhlw-00026 with backported fixes for CVE-2026-64607 and CVE-2026-71290. CVE-2026-64607: Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS CVE-2026-71290: Apache HttpComponents Client: TLS hostname verification silently disabled on the async transport (default config, MITM) This patched artifact is a drop-in replacement for org.apache.httpcomponents.client5:httpclient5 5.6.1 from Maven Central.

    References: https://repo.maven.apache.org/maven2/, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64607.json, https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q, https://nvd.nist.gov/vuln/detail/CVE-2026-64607, https://github.com/advisories/GHSA-hjcp-jmpx-g3qm, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71290.json, https://lists.apache.org/thread/bhf7g2zwpom2ohvwjjjlonc93br2s8vq, https://nvd.nist.gov/vuln/detail/CVE-2026-71290

    Affected packages

    Package

    Name: org.apache.httpcomponents.client5:httpclient5

    Purl: pkg:maven/org.apache.httpcomponents.client5/httpclient5

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -5.6.1.rhlw-00026

    Affected versions

    5.0
    5.0.1
    5.0.2
    5.0.3
    5.0.4

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    RHLW-2026-639f255bd180ae78 | CVE-DB