Repository navigation
Upgrade Apache HttpClient to version 5 #154
Description
Description
Apache HttpClient in version 4 is kinda old and not used in newer apps.
Last release was in 2022.
Please consider upgrading client to version 5.
Discussion
No response
Motivation
Newer applications are already using HttpClient 5 and had removed all HttpClient 4 dependencies (like Spring-based 3.x apps).
All components f.e. micrometer for client in version 4 are already deprecated.
I have to individually create an old client with monitoring and custom settings only for PolicyEnforcer purposes.
Details
No response
Reacted by Bragolgirith, Ladislav Račák, Samuel, Maximilian Teegen, Ayk Borstelmann, Cornel and Sebastian Koller
Activity
jonkoops commentedon Feb 13, 2025
What Java versions are supported for Apache HttpClient in version 5? We still have a minimal support target for Java 11.
maltanky commentedon Feb 13, 2025
According to: https://downloads.apache.org/httpcomponents/httpclient/RELEASE_NOTES-5.4.x.txt
minimal Java version is 8 since HttpClient version 5.2
jonkoops commentedon Feb 13, 2025
Ok great, yeah don't see why we could not do the upgrade. As long as we're not pushing any user-facing breaking changes because of it. Let me triage this one.
andre161292 commentedon Jul 10, 2025
This is especially important, as the HttpClient 4 deadlocks itself when executed in virtual threads. See https://stackoverflow.com/a/78805574/589216 and https://gist.github.com/mszajna/905d122bc4a87056a4ab415ac83ede9f.
The root cause is the use of the synchronized block in the HttpClient 4, that, when executed in a virtual thread, pins the virtual thread to the platform thread under heavy load. This is a java issue that is fixed by https://openjdk.org/jeps/491 in Java 24, but all prior versions are affected.
We had this issue in multiple projects and had to disable virtual threads cause we used the Keycloak client library.
As the new HttpClient doesn't use synchronized blocks anymore, the issue wouldn't pursue even in Java version <24.
Maybe a reason to rise the priority? :)
stefan751-tgw commentedon Jul 7, 2026
Since HttpClient 4 has high rated CVEs, shouldn't this issue get a higher priority?
https://nvd.nist.gov/vuln/search#/nvd/home?sortOrder=3&sortDirection=2&cpeFilterMode=applicability&cpeName=cpe:2.3:a:apache:httpcomponents_core:4.4.16:*:*:*:*:*:*:*&resultType=records