CVE-2026-54399
Apache HttpComponents Core: Unbounded HTTP Header/Line Length in Default Configuration
Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending messages with excessive number of headers / excessive header length
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Apache HttpComponents Core: Unbounded HTTP Header/Line Length in Default Configuration
Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending messages with excessive number of headers / excessive header length
- Record
CVE-2026-54399- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
EUVDEUVD-2026-41094
Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending messages with excessive number of headers / excessive header length
- Record
EUVD-2026-41094- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-hf6x-8p5f-cgmf
Apache HttpComponents Core HTTP/1 header parsing can cause memory-exhaustion denial of service
Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows a remote attacker to cause a denial of service through memory exhaustion by sending messages with excessive number of headers / excessive header length
- Record
GHSA-hf6x-8p5f-cgmf- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
NVD
Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending messages with excessive number of headers / excessive header length
- Record
CVE-2026-54399- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSV
Apache HttpComponents Core: Unbounded HTTP Header/Line Length in Default Configuration
Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending messages with excessive number of headers / excessive header length
- Record
CVE-2026-54399- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-54399
Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending messages with excessive number of headers / excessive header length
- Record
DEBIAN-CVE-2026-54399- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 10 moreShow less
OSVGHSA-hf6x-8p5f-cgmf
Apache HttpComponents Core HTTP/1 header parsing can cause memory-exhaustion denial of service
Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows a remote attacker to cause a denial of service through memory exhaustion by sending messages with excessive number of headers / excessive header length
- Record
GHSA-hf6x-8p5f-cgmf- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-54399
Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending messages with excessive number of headers / excessive header length
- Record
UBUNTU-CVE-2026-54399- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVCLSA-2026-1779151612 No score
TuxCare security update for com.github.pjfanning:excel-streaming-reader (2 CVEs)
TuxCare rebuilt com.github.pjfanning:excel-streaming-reader to address 2 CVEs. Fixed in 5.0.2-tuxcare.1.
- Record
CLSA-2026-1779151612- Updated
- 2026-11-02
OSVCLSA-2026-1788763778 No score
TuxCare security update for org.apache.httpcomponents.core5 (2 CVEs)
TuxCare rebuilt 2 org.apache.httpcomponents.core5 packages to address 2 CVEs. Fixed in 5.2.5-tuxcare.1.
- Record
CLSA-2026-1788763778- Updated
- 2026-11-02
OSVCLSA-2026-1789369705 No score
TuxCare security update for org.apache.httpcomponents.core5 (2 CVEs)
TuxCare rebuilt 2 org.apache.httpcomponents.core5 packages to address 2 CVEs. Fixed in 5.2.4-tuxcare.1.
- Record
CLSA-2026-1789369705- Updated
- 2026-11-02
OSVCLSA-2026-1789369756 No score
TuxCare security update for org.apache.httpcomponents.core5 (2 CVEs)
TuxCare rebuilt 2 org.apache.httpcomponents.core5 packages to address 2 CVEs. Fixed in 5.0.2-tuxcare.1.
- Record
CLSA-2026-1789369756- Updated
- 2026-11-02
OSVCLSA-2026-1789383190 No score
TuxCare security update for org.apache.httpcomponents.core5 (2 CVEs)
TuxCare rebuilt 2 org.apache.httpcomponents.core5 packages to address 2 CVEs. Fixed in 5.1.5-tuxcare.1.
- Record
CLSA-2026-1789383190- Updated
- 2026-11-02
OSVCLSA-2026-1789467085 No score
TuxCare security update for org.apache.httpcomponents.core5:httpcore5 (1 CVE)
TuxCare rebuilt org.apache.httpcomponents.core5:httpcore5 to address 1 CVE. Fixed in 5.1.3-tuxcare.1.
- Record
CLSA-2026-1789467085- Updated
- 2026-11-02
OSVCLSA-2026-1793728462 No score
TuxCare security update for org.apache.httpcomponents.core5:httpcore5 (1 CVE)
TuxCare rebuilt org.apache.httpcomponents.core5:httpcore5 to address 1 CVE. Fixed in 5.3.4-tuxcare.2.
- Record
CLSA-2026-1793728462- Updated
- 2026-11-04
OSVROOT-APP-MAVEN-CVE-2026-54399 No score
CVE-2026-54399 in org.apache.httpcomponents.core5:httpcore5 - Patched by Root
Root has patched CVE-2026-54399 in the org.apache.httpcomponents.core5:httpcore5 package for Root:Maven. Multiple fixed versions available.
- Record
ROOT-APP-MAVEN-CVE-2026-54399- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.httpcomponents.core5:httpcore5Maven |
before 5.4.3 | 5.4.3 |
org.apache.httpcomponents.core5:httpcore5Maven |
5.5-alpha1 up to 5.5-beta2 | 5.5-beta2 |
org.apache.httpcomponents.core5:httpcore5TuxCare:Maven From an advisory covering 2 CVEs |
5.2.5 up to 5.2.5-tuxcare.1 | 5.2.5-tuxcare.1 |
org.apache.httpcomponents.core5:httpcore5-h2TuxCare:Maven From an advisory covering 2 CVEs |
5.2.5 up to 5.2.5-tuxcare.1 | 5.2.5-tuxcare.1 |
org.apache.httpcomponents.core5:httpcore5TuxCare:Maven From an advisory covering 2 CVEs |
5.2.4 up to 5.2.4-tuxcare.1 | 5.2.4-tuxcare.1 |
org.apache.httpcomponents.core5:httpcore5-h2TuxCare:Maven From an advisory covering 2 CVEs |
5.2.4 up to 5.2.4-tuxcare.1 | 5.2.4-tuxcare.1 |
org.apache.httpcomponents.core5:httpcore5TuxCare:Maven From an advisory covering 2 CVEs |
5.0.2 up to 5.0.2-tuxcare.1 | 5.0.2-tuxcare.1 |
org.apache.httpcomponents.core5:httpcore5-h2TuxCare:Maven From an advisory covering 2 CVEs |
5.0.2 up to 5.0.2-tuxcare.1 | 5.0.2-tuxcare.1 |
org.apache.httpcomponents.core5:httpcore5TuxCare:Maven From an advisory covering 2 CVEs |
5.1.5 up to 5.1.5-tuxcare.1 | 5.1.5-tuxcare.1 |
org.apache.httpcomponents.core5:httpcore5-h2TuxCare:Maven From an advisory covering 2 CVEs |
5.1.5 up to 5.1.5-tuxcare.1 | 5.1.5-tuxcare.1 |
Show 26 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.apache.httpcomponents.core5:httpcore5TuxCare:Maven |
5.1.3 up to 5.1.3-tuxcare.1 | 5.1.3-tuxcare.1 |
org.apache.httpcomponents.core5:httpcore5TuxCare:Maven |
5.3.4 up to 5.3.4-tuxcare.2, plus listed versions 5.3.4-tuxcare.1 |
5.3.4-tuxcare.2 |
httpcomponents-coreDebian:12 |
All versions, plus listed versions 4.4.16-1 |
None known |
httpcomponents-coreDebian:13 |
All versions, plus listed versions 4.4.16-1 |
None known |
httpcomponents-coreDebian:14 |
All versions, plus listed versions 4.4.16-1 |
None known |
httpcomponents-core5Debian:12 |
All versions, plus listed versions 5.2.1-15.2.2-15.2.2-25.4-15.4.2-1 Show 4 moreShow less5.4.2-1.15.4.2-25.4.3-15.4.4-1 |
None known |
httpcomponents-core5Debian:13 |
All versions, plus listed versions 5.2.2-15.2.2-25.4-15.4.2-15.4.2-1.15.4.2-25.4.3-15.4.4-1 |
None known |
httpcomponents-core5Debian:14 |
before 5.4.3-1, plus listed versions 5.2.2-15.2.2-25.4-15.4.2-15.4.2-1.15.4.2-2 |
5.4.3-1 |
org.apache.httpcomponents.core5:httpcore5Maven |
before 5.4.3, plus listed versions 5.05.0-alpha15.0-alpha25.0-alpha35.0-alpha4 Show 45 moreShow less5.0-beta15.0-beta105.0-beta115.0-beta25.0-beta35.0-beta45.0-beta55.0-beta65.0-beta75.0-beta85.0-beta95.0.15.0.25.0.35.0.45.15.1-beta15.1-beta25.1-beta35.1.15.1.25.1.35.1.45.1.55.25.2-alpha15.2-alpha25.2-beta15.2-beta25.2.15.2.25.2.35.2.45.2.55.35.3-alpha15.3-alpha25.3-beta15.3.15.3.25.3.35.3.45.3.55.3.65.4 |
5.4.3 |
org.apache.httpcomponents.core5:httpcore5Maven |
5.5-alpha1 up to 5.5-beta2, plus listed versions 5.5-beta1 |
5.5-beta2 |
org.apache.httpcomponents.core5:httpcore5Root:Maven |
before 5.3.5-aikido.1 | 5.3.5-aikido.15.1.3-aikido.15.3.4-aikido.15.3.1-aikido.15.3.6-aikido.15.4-aikido.15.2-aikido.15.2-aikido.25.3.3-aikido.1 |
io.root.org.apache.httpcomponents.core5:httpcore5Root:Maven |
before 5.3.5-root.io.1 | 5.3.5-root.io.15.1.3-root.io.15.3.4-root.io.15.3.1-root.io.15.3.6-root.io.15.4-root.io.15.2-root.io.15.2-root.io.25.3.3-root.io.1 |
httpcomponents-coreUbuntu:14.04:LTS |
All versions, plus listed versions 4.2.4-14.3-14.3.1-14.3.2-14.3.2-2 |
None known |
httpcomponents-coreUbuntu:16.04:LTS |
All versions, plus listed versions 4.4.1-14.4.3-14.4.4-1 |
None known |
httpcomponents-coreUbuntu:18.04:LTS |
All versions, plus listed versions 4.4.7-14.4.8-14.4.9-1 |
None known |
httpcomponents-coreUbuntu:20.04:LTS |
All versions, plus listed versions 4.4.11-14.4.12-14.4.13-1 |
None known |
httpcomponents-coreUbuntu:22.04:LTS |
All versions, plus listed versions 4.4.14-14.4.14-2 |
None known |
httpcomponents-core5Ubuntu:22.04:LTS |
All versions, plus listed versions 5.1.2-15.1.2-25.1.3-1 |
None known |
httpcomponents-coreUbuntu:24.04:LTS |
All versions, plus listed versions 4.4.16-1 |
None known |
httpcomponents-core5Ubuntu:24.04:LTS |
All versions, plus listed versions 5.2.1-15.2.2-1 |
None known |
httpcomponents-coreUbuntu:25.10 |
All versions, plus listed versions 4.4.16-1 |
None known |
httpcomponents-core5Ubuntu:25.10 |
All versions, plus listed versions 5.2.2-1 |
None known |
httpcomponents-coreUbuntu:26.10 |
All versions, plus listed versions 4.4.16-1build1 |
None known |
httpcomponents-core5Ubuntu:26.10 |
All versions, plus listed versions 5.4-15.4.2-1.15.4.3-1 |
None known |
httpcomponents-coreUbuntu:26.04:LTS |
All versions, plus listed versions 4.4.16-14.4.16-1build1 |
None known |
httpcomponents-core5Ubuntu:26.04:LTS |
All versions, plus listed versions 5.2.2-15.2.2-25.4-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| affected, aliases, facts | OSV | |
| affected | ||
| affected | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-54399 is a high vulnerability (CVSS 7.5) in Apache Httpcomponents Core, published July 1, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.78%, the 56th percentile. Fixed in org.apache.httpcomponents.core5:httpcore5 5.4.3.
References
lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy
openwall.com/lists/oss-security/2026/07/01/4
nvd.nist.gov/vuln/detail/CVE-2026-54399
github.com/apache/httpcomponents-core/commit/d96a00fec9b2e19f8005e35681df5f6cd6e21a9e
Left out here: 3 versions. The JSON record has them.