Overview
This advisory addresses a known security vulnerability identified in a third-party dependency used within DPGW.
Vulnerability Details
- CVE ID: CVE-2026-64607 (CWE-772, Missing Release of Resource after Effective Lifetime; disclosed 2026-08-13, finder Yu Bao, PayPal Cyber Security Team)
- Dependency Name: org.apache.httpcomponents.client5:httpclient5
- Affected Version of Dependency:
5.0-alpha1–5.6.2— fixed in 5.6.3 (5.6.4 is the current release) - Severity Score: 5.3 Medium (
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, CISA-ADP). NVD has not yet published its own analysis; the ASF rates the issue Important.
Affected Versions of DPGW
All maintained branches declare httpclient5 as a direct, explicitly pinned dependency and bundle a vulnerable version:
- 1.12 — all releases (<= 1.12.53-REL), bundles
httpclient55.4.4 - 1.13 — all releases (<= 1.13.32-REL), bundles
httpclient55.5.1 - 1.14 — all releases (<= 1.14.09-REL), bundles
httpclient55.6.1
Risk Assessment & Applicability
Usage
DPGW uses Apache HttpClient 5 as its general-purpose outbound HTTP client. It is not used to serve inbound requests — that is Jetty’s role — so the vulnerable component is only exercised when DPGW acts as a client against a remote endpoint.
Outbound clients are centrally constructed by org.medoro.dpgw.base.priv.webclient.WebClientFactoryImpl.createHttpClientBuilder(...), which builds a classic (blocking) I/O CloseableHttpClient on top of a PoolingHttpClientConnectionManager (PoolConcurrencyPolicy.STRICT, maxConnTotal / maxConnPerRoute taken from the named WebClientParameters configuration). Roughly 130 source files reference org.apache.hc.*; the classic client is the variant used almost everywhere, including:
org.medoro.dpgw.web.common.replica.CentralServerConnection— replication sync against the central serverorg.medoro.dpgw.modules.cloudpacsclient.priv.*— CloudPACS API callsorg.medoro.dpgw.modules.dexclient.priv.*— DEX control connectionorg.medoro.dpgw.dicom.plugin.CStoreStowRSPlugin/CStoreToStowRSPlugin/CStoreToDrSejfPlugin/CMoveToCloudPACSPlugin— DICOMweb / STOW-RS forwardingorg.medoro.dpgw.base.pub.license.LicenseServer,OAuth2WebClientFactoryPlugins,JWTWebClientFactoryPlugins,HelpDownloader,SharedUserAccountServlet,DPGWHttpClient
The async I/O client (HttpAsyncClientBuilder, used by SSEClient and by CentralServerConnection for its SSE channel) is built by createHttpAsyncClientBuilder(...) and is not affected by this defect.
Response content decoding is enabled by default: WebClientParameters.httpCompression defaults to true, and WebClientFactoryImpl only calls disableContentCompression() when it is explicitly set to false. The ContentCompressionExec interceptor — where the defect lives — is therefore present in the default execution chain of every configured web client.
Analysis
CVE-2026-64607 is a connection-leak defect in HttpClient’s classic I/O execution chain. When a response carries a Content-Encoding header whose value is not a supported/registered encoding, the content-decoding stage fails before the response entity is consumed, and the underlying connection is not released back to the connection manager. Each such response permanently removes one connection from the pool. Once the pool’s maxConnTotal / maxConnPerRoute limit is reached, subsequent requests block until the connection-request timeout expires and then fail — a denial-of-service condition for that client. The async I/O model is not affected.
In DPGW the vulnerable code path is reachable: the classic pooled client is the default, and content decoding is on by default.
Exploitation is, however, not a generic network attack. The malformed response has to come from an HTTP endpoint DPGW is configured to call — the replication central server, a CloudPACS instance, a DEX control server, a DICOMweb/STOW-RS peer, the license server, or a configured OAuth2/JWT identity provider. All of these are administratively provisioned, and connections are made over TLS with strict protocol and hostname validation (DefaultClientTlsStrategy, TLS 1.2/1.3). An attacker must therefore either compromise one of these configured peers or hold a TLS man-in-the-middle position, which substantially raises attack complexity.
The blast radius is also bounded by how DPGW manages client lifetimes. Most call sites build a client per operation inside a try-with-resources block; closing the client discards its pool, so any leaked connection is reclaimed at the end of that operation. The meaningful exposure is the small set of long-lived pooled clients that persist across operations — most notably CentralServerConnection.syncHttpClient (cached replication sync client) and the DEX control connection — where leaked connections accumulate until the pool is exhausted. The effect is degradation of the affected integration (e.g. replication or cloud PACS traffic stalls), not compromise of the gateway or of stored data; confidentiality and integrity are unaffected.
Status
Affected
Severity Score in the context of DPGW: 3.7 Low CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
The vector is lowered from the published AC:L to AC:H because the attacker must control, compromise, or impersonate a remote endpoint that DPGW is explicitly configured to contact over TLS; it is not reachable by an arbitrary network party. Availability impact remains Low: exhaustion is confined to a single named web client’s pool and degrades that one integration.
Impact on DPGW
A malicious or malfunctioning remote peer that returns responses with an invalid or unsupported Content-Encoding header can progressively exhaust the connection pool of the DPGW web client talking to it. Practical consequences are stalled or failing replication sync, CloudPACS API calls, DEX control traffic, or DICOMweb forwarding towards that peer, until DPGW is restarted or the affected client is rebuilt. There is no impact on confidentiality or integrity of patient data, and no impact on DPGW’s inbound (Jetty) request handling.
Remediation & Mitigations
Scheduled fix
Upgrade the bundled org.apache.httpcomponents.client5:httpclient5 to 5.6.3 or later (current release: 5.6.4). The bump will roll into the maintained branches as part of routine dependency maintenance:
- 1.14 — pending (5.6.1 → 5.6.4)
- 1.13 — pending (5.5.1 → 5.6.4)
- 1.12 — pending (5.4.4 → 5.6.4)
User Actions
No user action is required in a standard deployment, where all configured web-client endpoints are trusted, administratively provisioned systems.
Where a remote endpoint is less trusted, exposure can be removed before the dependency upgrade by disabling response content decoding on the affected web client — set httpCompression="false" on the relevant WebClientParameters configuration entry. This takes ContentCompressionExec out of the execution chain entirely, at the cost of losing gzip/deflate response compression for that client.
Symptoms of an ongoing leak are repeated connection-request timeouts against a single endpoint while that endpoint is otherwise reachable; restarting DPGW clears the exhausted pools.