Riskcovery

CVE-2026-54428

Apache HttpComponents Core: HPackDecoder Unlimited Header List Size Before SETTINGS ACK

State
Published
Severity
7.5 High
Published
Jul 1, 2026
Updated
Jul 1, 2026
Reserved
Jun 14, 2026

Read the record on cve.org

Description

Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending oversized compressed header blocks before the HTTP/2 SETTINGS acknowledgement causes the configured header list size limit to be applied.

Scores

CVSSScoreVectorSource
3.17.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCISA-ADP

Weaknesses

  • CWE-770 Allocation of Resources Without Limits or Throttling
  • CWE-400 Uncontrolled Resource Consumption

Affected Products

ProductVersions
Apache HttpComponents CoreApache Software Foundation
  • 5.5-alpha through 5.5-beta1Affected
  • 5.0-alpha through 5.4.2Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.