diff --git a/Jarfile b/Jarfile
index f6643ae1..052fd0b2 100644
--- a/Jarfile
+++ b/Jarfile
@@ -13,9 +13,9 @@ jar 'com.github.crawler-commons:crawler-commons', '1.2'
 jar 'commons-io:commons-io', '2.16.1'
 
 # Apache HTTP client used for requests to websites
-# Pinned to 5.6.2+ to pull in httpcore5/httpcore5-h2 5.4.3, resolving
-# CVE-2025-8671, CVE-2026-54399, and CVE-2026-54428 (HTTP DoS in httpcore5-h2).
-jar 'org.apache.httpcomponents.client5:httpclient5', '5.6.2'
+# Pinned to 5.6.3+ to resolve CVE-2026-64607 (connection leak on bad Content-Encoding)
+# and to pull in httpcore5/httpcore5-h2 5.4.3 (CVE-2025-8671, CVE-2026-54399, CVE-2026-54428).
+jar 'org.apache.httpcomponents.client5:httpclient5', '5.6.3'
 
 # For managing Brotli input streams
 jar 'org.apache.commons:commons-compress', '1.27.1'
diff --git a/Jars.lock b/Jars.lock
index bbcab7c1..b6464c62 100644
--- a/Jars.lock
+++ b/Jars.lock
@@ -14,7 +14,7 @@ org.bouncycastle:bcutil-jdk18on:1.84:compile:
 com.github.crawler-commons:crawler-commons:1.2:compile:
 org.slf4j:slf4j-api:1.7.7:compile:
 commons-io:commons-io:2.16.1:compile:
-org.apache.httpcomponents.client5:httpclient5:5.6.2:compile:
+org.apache.httpcomponents.client5:httpclient5:5.6.3:compile:
 org.apache.httpcomponents.core5:httpcore5:5.4.3:compile:
 org.apache.httpcomponents.core5:httpcore5-h2:5.4.3:compile:
 org.apache.commons:commons-compress:1.27.1:compile:
diff --git a/vendor/jars/org/apache/httpcomponents/client5/httpclient5/5.6.2/httpclient5-5.6.2.jar b/vendor/jars/org/apache/httpcomponents/client5/httpclient5/5.6.3/httpclient5-5.6.3.jar
similarity index 84%
rename from vendor/jars/org/apache/httpcomponents/client5/httpclient5/5.6.2/httpclient5-5.6.2.jar
rename to vendor/jars/org/apache/httpcomponents/client5/httpclient5/5.6.3/httpclient5-5.6.3.jar
index eb1d05e2..47f5d6ef 100644
Binary files a/vendor/jars/org/apache/httpcomponents/client5/httpclient5/5.6.2/httpclient5-5.6.2.jar and b/vendor/jars/org/apache/httpcomponents/client5/httpclient5/5.6.3/httpclient5-5.6.3.jar differ