CVE-2026-54428: httpcomponents core from 5.0 (inclusive), through 5.4.2 (inclusive), 5.5 · update alpha1, 5.5 · update beta1; +1 more…

Affected technology

httpcomponents core · from 5.0 (inclusive), through 5.4.2 (inclusive)
apache

httpcomponents core · 5.5 · update alpha1
apache

httpcomponents core · 5.5 · update beta1
apache

Apache HttpComponents Core · 5.5-alpha through 5.5-beta1, 5.0-alpha through 5.4.2
Apache Software Foundation

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

An remote attacker can cause a denial of service through memory exhaustion by sending oversized compressed header blocks before the HTTP/2 SETTINGS acknowledgement causes the configured header list size limit to be applied. Source advisory’s CVSS 3.1 assessment (base score 7.5/10) rates confidentiality and integrity impact as none; availability impact as high.