CVE-2026-54399

HighCVSS 7.5

Published: 01/07/2026(UTC)Updated: 24/07/2026(UTC)Translated: 07/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.57%

44th percentile - higher than 44% of all known CVEs

Summary

An uncontrolled resource consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core (versions 5.4.2 and earlier, 5.5-beta1 and earlier) allows a remote attacker to cause a denial of service through memory exhaustion by sending messages with an excessive number of headers or excessive header length.

Risk Assessment

The organization is at risk of DoS attacks that could lead to unavailability of services based on Apache HttpComponents Core, potentially disrupting web applications and dependent systems.

Recommendation

Immediately upgrade Apache HttpComponents Core to version 5.4.3 or later (post 5.5-beta1), which includes a fix that limits the number and length of HTTP headers.

Other vulnerabilities in Apache HttpComponents Core

CVE-2026-54428High
A vulnerability in the HTTP/2 HPACK decoder in Apache HttpComponents Core (versions 5.4.2 and earlier, 5.5-beta1 and earlier) allows a remote attacker to cause a denial of service through memory exhaustion by sending oversized compressed header blocks before the HTTP/2 SETTINGS acknowledgement applies the configured header list size limit.

Original NVD description (English source)

Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending messages with excessive number of headers / excessive header length