CVE-2026-64607¶
WSO2 Products impacted: no
Customer action required: no
REPORTED VULNERABILITY¶
Apache HttpClient based on the classic I/O model fails to correctly release the underlying connection back to the connection manager when it encounters an invalid or unsupported Content-Encoding header value in a response message. Repeated occurrences can exhaust the connection pool. The defect affects Apache HttpComponents Client from 5.0-alpha1 through 5.6.2 and does not affect the async I/O model.1
REPORTED PRODUCTS¶
- WSO2 Identity Server : 7.2.0, 7.3.0
WSO2 JUSTIFICATION¶
The reported httpclient5 artifact is not used directly by WSO2 Identity Server. It is nested inside the Yubico WebAuthn library bundle, where it is used only for hostname matching during a WebAuthn/FIDO2 registration in which the enrolling authenticator submits an android-safetynet attestation statement.
The vulnerable code path is not exercised in the product for two independent reasons:
The throw that starts the leak is guarded. The exception that leaves the connection unreleased originates in ContentCompressionExec and is raised only when its ignoreUnknown flag is false. In the shipped bytecode, HttpClientBuilder passes that flag as true at both of its construction sites, so a client built through the standard builder cannot reach the throw.
The classic execution chain is never assembled. The Yubico WebAuthn library references only DefaultHostnameVerifier from HttpClient - it does not reference CloseableHttpClient, HttpClientBuilder, HttpClients or ContentCompressionExec, and therefore never constructs an HTTP client at all. This matches the hostname-matching-only usage described above. The bundle additionally neither imports nor exports any org.apache.hc.client5 package, so the nested copy remains private to it and no other component in the runtime binds to it.
All outbound HTTPS traffic in WSO2 Identity Server is served by the Carbon HTTP client utilities, which use a separate, product-level HttpClient distribution.
That product-level distribution is also within the affected range, and is likewise not exploitable. The ContentCompressionExec class it contains is present, but the leak begins at a throw that is guarded by the same ignoreUnknown flag, which HttpClientBuilder passes as true at both of its construction sites. Every component that builds an HTTP client in the product does so through HttpClientBuilder or HttpClients, none references ContentCompressionExec directly, and the httpclient5-cache module - which offers an alternative execution-chain builder - is not shipped. There is therefore no code path in the product that can reach the unreleased connection. A caller that explicitly supplied ignoreUnknown=false would be exposed, but the product contains none.
Based on this evidence, we conclude that this vulnerability does not pose a security risk to the impacted versions of WSO2 products listed above. As a hardening measure, both affected HttpClient distributions will be moved to a fixed version in a future release: the product-level distribution used by the Carbon HTTP client utilities will be upgraded directly, and the Yubico WebAuthn bundle will be refreshed so that its nested distribution moves with it.