Apache Software Foundation Apache HttpComponents Core

• CVE-2026-54428 High 7.5 Apache HttpComponents Core: HPackDecoder Unlimited Header List Size Before SETTINGS ACK 0.9%
• CVE-2026-54399 High 7.5 Apache HttpComponents Core: Unbounded HTTP Header/Line Length in Default Configuration 0.8%