Log in Start free

Vulnerability · Published Jul 1, 2026 · Assigned by apache

CVE-2026-54428Apache HttpComponents Core: HPackDecoder Unlimited Header List Size Before SETTINGS ACK

High 7.5

In plain English

A high-severity resource allocation without limits in Apache HttpComponents Core from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.9%top 41.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending oversized compressed header blocks before the HTTP/2 SETTINGS acknowledgement causes the configured header list size limit to be applied.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:13httpcomponents-coreno fix listedDEBIAN-CVE-2026-54428
Debian:14httpcomponents-coreno fix listedDEBIAN-CVE-2026-54428
Debian:12httpcomponents-core5no fix listedDEBIAN-CVE-2026-54428
Debian:13httpcomponents-core5no fix listedDEBIAN-CVE-2026-54428
Debian:14httpcomponents-core55.4.3-1DEBIAN-CVE-2026-54428
Mavenorg.apache.httpcomponents.core5:httpcore5-h25.4.3GHSA-v3jc-474w-2wm6
Mavenorg.apache.httpcomponents.core5:httpcore5-h25.5-beta2GHSA-v3jc-474w-2wm6
Ubuntu:22.04:LTShttpcomponents-coreno fix listedUBUNTU-CVE-2026-54428
Ubuntu:24.04:LTShttpcomponents-coreno fix listedUBUNTU-CVE-2026-54428
Ubuntu:25.10httpcomponents-coreno fix listedUBUNTU-CVE-2026-54428
Ubuntu:26.04:LTShttpcomponents-coreno fix listedUBUNTU-CVE-2026-54428
Ubuntu:26.10httpcomponents-coreno fix listedUBUNTU-CVE-2026-54428
Ubuntu:22.04:LTShttpcomponents-core5no fix listedUBUNTU-CVE-2026-54428
Ubuntu:24.04:LTShttpcomponents-core5no fix listedUBUNTU-CVE-2026-54428
Ubuntu:25.10httpcomponents-core5no fix listedUBUNTU-CVE-2026-54428
Ubuntu:26.04:LTShttpcomponents-core5no fix listedUBUNTU-CVE-2026-54428
Ubuntu:26.10httpcomponents-core5no fix listedUBUNTU-CVE-2026-54428

Affected products (as reported)

VendorProductVersions
Apache Software Foundation Apache HttpComponents Core 5.5-alpha – through 5.5-beta15.0-alpha – through 5.4.2

Weakness: CWE-770, CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References