httpcomponents-client - Debian Package Tracker

general

source: httpcomponents-client (main)
version: 4.5.14-1
maintainer: Debian Java Maintainers (archive) (DMD)
uploaders: Jakub Adam [DMD] – Emmanuel Bourg [DMD]
arch: all
std-ver: 4.6.1
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 4.5.13-2
oldstable: 4.5.14-1
stable: 4.5.14-1
testing: 4.5.14-1
unstable: 4.5.14-1

versioned links

4.5.13-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
4.5.14-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libhttpclient-java (1 bugs: 0, 0, 1, 0)
libhttpmime-java

action needed

1 security issue in trixie high

There is 1 open security issue in trixie.

1 important issue:

CVE-2026-64607: HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-Encoding` header value in the response message. Please note this defect does not affect HttpClient based on the async i/o model. This issue affects Apache HttpComponents Client: from 5.0-alpha1 through 5.6.2.

Created: 2026-07-31 Last update: 2026-09-01 22:00

1 security issue in sid high

There is 1 open security issue in sid.

1 important issue:

CVE-2026-64607: HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-Encoding` header value in the response message. Please note this defect does not affect HttpClient based on the async i/o model. This issue affects Apache HttpComponents Client: from 5.0-alpha1 through 5.6.2.

Created: 2026-07-31 Last update: 2026-09-01 22:00

1 security issue in forky high

There is 1 open security issue in forky.

1 important issue:

CVE-2026-64607: HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-Encoding` header value in the response message. Please note this defect does not affect HttpClient based on the async i/o model. This issue affects Apache HttpComponents Client: from 5.0-alpha1 through 5.6.2.

Created: 2026-07-31 Last update: 2026-09-01 22:00

1 security issue in bookworm high

There is 1 open security issue in bookworm.

1 important issue:

CVE-2026-64607: HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-Encoding` header value in the response message. Please note this defect does not affect HttpClient based on the async i/o model. This issue affects Apache HttpComponents Client: from 5.0-alpha1 through 5.6.2.

Created: 2026-07-31 Last update: 2026-09-01 22:00

2 security issues in bullseye high

There are 2 open security issues in bullseye.

2 important issues:

CVE-2026-64607: HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-Encoding` header value in the response message. Please note this defect does not affect HttpClient based on the async i/o model. This issue affects Apache HttpComponents Client: from 5.0-alpha1 through 5.6.2.
CVE-2026-71290: Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicy#BUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonate the server by presenting a valid certificate for a different domain. Please note the classic version of HttpClient is not affected by this vulnerability. Affected users are recommended to upgrade to at least version 5.6.4, which fixes the issue.

Created: 2026-07-31 Last update: 2026-08-14 06:32

1 bug tagged patch in the BTS normal

The BTS contains patches fixing 1 bug, consider including or untagging them.

Created: 2026-09-02 Last update: 2026-09-14 01:01

lintian reports 5 warnings normal

Lintian reports 5 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2021-10-13 Last update: 2021-10-13 21:32

debian/patches: 2 patches to forward upstream low

Among the 4 debian patches available in version 4.5.14-1 of the package, we noticed the following issues:

2 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2023-02-26 Last update: 2023-02-26 15:54

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.4 instead of 4.6.1).

Created: 2022-12-17 Last update: 2026-03-31 15:01

news

[rss feed]

[2022-12-11] httpcomponents-client 4.5.14-1 MIGRATED to testing (Debian testing watch)
[2022-12-06] Accepted httpcomponents-client 4.5.14-1 (source) into unstable (Emmanuel Bourg)
[2021-09-22] httpcomponents-client 4.5.13-3 MIGRATED to testing (Debian testing watch)
[2021-09-17] Accepted httpcomponents-client 4.5.13-3 (source) into unstable (Emmanuel Bourg)
[2021-04-20] httpcomponents-client 4.5.13-2 MIGRATED to testing (Debian testing watch)
[2021-04-14] Accepted httpcomponents-client 4.5.13-2 (source) into unstable (Markus Koschany)
[2020-10-16] Accepted httpcomponents-client 4.5.7-1+deb10u1 (source all) into proposed-updates->stable-new, proposed-updates (Debian FTP Masters) (signed by: Markus Koschany)
[2020-10-15] httpcomponents-client 4.5.13-1 MIGRATED to testing (Debian testing watch)
[2020-10-14] Accepted httpcomponents-client 4.5.7-1+deb10u1 (source all) into stable->embargoed, stable (Debian FTP Masters) (signed by: Markus Koschany)
[2020-10-10] Accepted httpcomponents-client 4.5.2-2+deb9u1 (source) into oldstable (Markus Koschany)
[2020-10-09] Accepted httpcomponents-client 4.5.13-1 (source) into unstable (Markus Koschany)
[2020-09-08] httpcomponents-client 4.5.12-1 MIGRATED to testing (Debian testing watch)
[2020-09-03] Accepted httpcomponents-client 4.5.12-1 (source) into unstable (Emmanuel Bourg)
[2020-01-31] httpcomponents-client 4.5.11-1 MIGRATED to testing (Debian testing watch)
[2020-01-25] Accepted httpcomponents-client 4.5.11-1 (source) into unstable (Emmanuel Bourg)
[2019-10-15] httpcomponents-client 4.5.10-2 MIGRATED to testing (Debian testing watch)
[2019-10-10] Accepted httpcomponents-client 4.5.10-2 (source) into unstable (Andrius Merkys)
[2019-10-10] httpcomponents-client 4.5.10-1 MIGRATED to testing (Debian testing watch)
[2019-10-05] Accepted httpcomponents-client 4.5.10-1 (source) into unstable (Emmanuel Bourg)
[2019-07-13] httpcomponents-client 4.5.9-1 MIGRATED to testing (Debian testing watch)
[2019-07-07] Accepted httpcomponents-client 4.5.9-1 (source) into unstable (Emmanuel Bourg)
[2019-02-03] httpcomponents-client 4.5.7-1 MIGRATED to testing (Debian testing watch)
[2019-01-28] Accepted httpcomponents-client 4.5.7-1 (source) into unstable (Emmanuel Bourg)
[2019-01-16] httpcomponents-client 4.5.6-2 MIGRATED to testing (Debian testing watch)
[2019-01-11] Accepted httpcomponents-client 4.5.6-2 (source) into unstable (Emmanuel Bourg)
[2018-08-12] httpcomponents-client 4.5.6-1 MIGRATED to testing (Debian testing watch)
[2018-08-06] Accepted httpcomponents-client 4.5.6-1 (source) into unstable (Emmanuel Bourg)
[2018-02-19] httpcomponents-client 4.5.5-1 MIGRATED to testing (Debian testing watch)
[2018-02-13] Accepted httpcomponents-client 4.5.5-1 (source) into unstable (Emmanuel Bourg)
[2018-01-17] httpcomponents-client 4.5.4-1 MIGRATED to testing (Debian testing watch)

bugs [bug history graph]

all: 2
RC: 0
I&N: 1
M&W: 1
F&P: 0
patch: 1

links

homepage
lintian (0, 5)
buildd: logs, reproducibility
popcon
browse source code
other distros
security tracker
debian patches

ubuntu

[Information about Ubuntu for Debian Developers]

version: 4.5.14-1build1
1 bug