CVE-2026-54428
Apache HttpComponents Core: HPackDecoder Unlimited Header List Size Before SETTINGS ACK
Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending oversized compressed header blocks before the HTTP/2 SETTINGS acknowledgement causes the configured header list size limit to be applied.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Apache HttpComponents Core: HPackDecoder Unlimited Header List Size Before SETTINGS ACK
Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending oversized compressed header blocks before the HTTP/2 SETTINGS acknowledgement causes the configured header list size limit to be applied.
- Record
CVE-2026-54428- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770, CWE-400
- Updated
- 2026-11-02
EUVDEUVD-2026-41095
Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending oversized compressed header blocks before the HTTP/2 SETTINGS acknowledgement causes the configured header list size limit to be applied.
- Record
EUVD-2026-41095- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-v3jc-474w-2wm6
Apache HttpComponents Core: HPackDecoder Unlimited Header List Size Before SETTINGS ACK
Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending oversized compressed header blocks before the HTTP/2 SETTINGS acknowledgement causes the configured header list size limit to be applied.
- Record
GHSA-v3jc-474w-2wm6- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
NVD
Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending oversized compressed header blocks before the HTTP/2 SETTINGS acknowledgement causes the configured header list size limit to be applied.
- Record
CVE-2026-54428- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400, CWE-770
- Updated
- 2026-11-02
OSV
Apache HttpComponents Core: HPackDecoder Unlimited Header List Size Before SETTINGS ACK
Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending oversized compressed header blocks before the HTTP/2 SETTINGS acknowledgement causes the configured header list size limit to be applied.
- Record
CVE-2026-54428- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400, CWE-770
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-54428
Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending oversized compressed header blocks before the HTTP/2 SETTINGS acknowledgement causes the configured header list size limit to be applied.
- Record
DEBIAN-CVE-2026-54428- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 9 moreShow less
OSVGHSA-v3jc-474w-2wm6
Apache HttpComponents Core: HPackDecoder Unlimited Header List Size Before SETTINGS ACK
Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending oversized compressed header blocks before the HTTP/2 SETTINGS acknowledgement causes the configured header list size limit to be applied.
- Record
GHSA-v3jc-474w-2wm6- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-54428
Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending oversized compressed header blocks before the HTTP/2 SETTINGS acknowledgement causes the configured header list size limit to be applied.
- Record
UBUNTU-CVE-2026-54428- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVCLSA-2026-1779151612 No score
TuxCare security update for com.github.pjfanning:excel-streaming-reader (2 CVEs)
TuxCare rebuilt com.github.pjfanning:excel-streaming-reader to address 2 CVEs. Fixed in 5.0.2-tuxcare.1.
- Record
CLSA-2026-1779151612- Updated
- 2026-11-02
OSVCLSA-2026-1788763778 No score
TuxCare security update for org.apache.httpcomponents.core5 (2 CVEs)
TuxCare rebuilt 2 org.apache.httpcomponents.core5 packages to address 2 CVEs. Fixed in 5.2.5-tuxcare.1.
- Record
CLSA-2026-1788763778- Updated
- 2026-11-02
OSVCLSA-2026-1789369705 No score
TuxCare security update for org.apache.httpcomponents.core5 (2 CVEs)
TuxCare rebuilt 2 org.apache.httpcomponents.core5 packages to address 2 CVEs. Fixed in 5.2.4-tuxcare.1.
- Record
CLSA-2026-1789369705- Updated
- 2026-11-02
OSVCLSA-2026-1789369756 No score
TuxCare security update for org.apache.httpcomponents.core5 (2 CVEs)
TuxCare rebuilt 2 org.apache.httpcomponents.core5 packages to address 2 CVEs. Fixed in 5.0.2-tuxcare.1.
- Record
CLSA-2026-1789369756- Updated
- 2026-11-02
OSVCLSA-2026-1789375936 No score
TuxCare security update for org.apache.httpcomponents.core5:httpcore5-h2 (1 CVE)
TuxCare rebuilt org.apache.httpcomponents.core5:httpcore5-h2 to address 1 CVE. Fixed in 5.3.4-tuxcare.1.
- Record
CLSA-2026-1789375936- Updated
- 2026-11-02
OSVCLSA-2026-1789383190 No score
TuxCare security update for org.apache.httpcomponents.core5 (2 CVEs)
TuxCare rebuilt 2 org.apache.httpcomponents.core5 packages to address 2 CVEs. Fixed in 5.1.5-tuxcare.1.
- Record
CLSA-2026-1789383190- Updated
- 2026-11-02
OSVROOT-APP-MAVEN-CVE-2026-54428 No score
CVE-2026-54428 in org.apache.httpcomponents.core5:httpcore5-h2 - Patched by Root
Root has patched CVE-2026-54428 in the org.apache.httpcomponents.core5:httpcore5-h2 package for Root:Maven. Multiple fixed versions available.
- Record
ROOT-APP-MAVEN-CVE-2026-54428- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.httpcomponents.core5:httpcore5-h2Maven |
before 5.4.3 | 5.4.3 |
org.apache.httpcomponents.core5:httpcore5-h2Maven |
5.5-alpha1 up to 5.5-beta2 | 5.5-beta2 |
org.apache.httpcomponents.core5:httpcore5TuxCare:Maven From an advisory covering 2 CVEs |
5.2.5 up to 5.2.5-tuxcare.1 | 5.2.5-tuxcare.1 |
org.apache.httpcomponents.core5:httpcore5-h2TuxCare:Maven From an advisory covering 2 CVEs |
5.2.5 up to 5.2.5-tuxcare.1 | 5.2.5-tuxcare.1 |
org.apache.httpcomponents.core5:httpcore5TuxCare:Maven From an advisory covering 2 CVEs |
5.2.4 up to 5.2.4-tuxcare.1 | 5.2.4-tuxcare.1 |
org.apache.httpcomponents.core5:httpcore5-h2TuxCare:Maven From an advisory covering 2 CVEs |
5.2.4 up to 5.2.4-tuxcare.1 | 5.2.4-tuxcare.1 |
org.apache.httpcomponents.core5:httpcore5TuxCare:Maven From an advisory covering 2 CVEs |
5.0.2 up to 5.0.2-tuxcare.1 | 5.0.2-tuxcare.1 |
org.apache.httpcomponents.core5:httpcore5-h2TuxCare:Maven From an advisory covering 2 CVEs |
5.0.2 up to 5.0.2-tuxcare.1 | 5.0.2-tuxcare.1 |
org.apache.httpcomponents.core5:httpcore5-h2TuxCare:Maven |
5.3.4 up to 5.3.4-tuxcare.1 | 5.3.4-tuxcare.1 |
org.apache.httpcomponents.core5:httpcore5TuxCare:Maven From an advisory covering 2 CVEs |
5.1.5 up to 5.1.5-tuxcare.1 | 5.1.5-tuxcare.1 |
Show 24 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.apache.httpcomponents.core5:httpcore5-h2TuxCare:Maven From an advisory covering 2 CVEs |
5.1.5 up to 5.1.5-tuxcare.1 | 5.1.5-tuxcare.1 |
httpcomponents-coreDebian:13 |
All versions, plus listed versions 4.4.16-1 |
None known |
httpcomponents-coreDebian:14 |
All versions, plus listed versions 4.4.16-1 |
None known |
httpcomponents-core5Debian:12 |
All versions, plus listed versions 5.2.1-15.2.2-15.2.2-25.4-15.4.2-1 Show 4 moreShow less5.4.2-1.15.4.2-25.4.3-15.4.4-1 |
None known |
httpcomponents-core5Debian:13 |
All versions, plus listed versions 5.2.2-15.2.2-25.4-15.4.2-15.4.2-1.15.4.2-25.4.3-15.4.4-1 |
None known |
httpcomponents-core5Debian:14 |
before 5.4.3-1, plus listed versions 5.2.2-15.2.2-25.4-15.4.2-15.4.2-1.15.4.2-2 |
5.4.3-1 |
org.apache.httpcomponents.core5:httpcore5-h2Maven |
before 5.4.3, plus listed versions 5.05.0-alpha25.0-alpha35.0-alpha45.0-beta1 Show 45 moreShow less5.0-beta105.0-beta115.0-beta25.0-beta35.0-beta45.0-beta55.0-beta65.0-beta75.0-beta85.0-beta95.0.15.0.25.0.35.0.45.15.1-beta15.1-beta25.1-beta35.1.15.1.25.1.35.1.45.1.55.25.2-alpha15.2-alpha25.2-beta15.2-beta25.2.15.2.25.2.35.2.45.2.55.35.3-alpha15.3-alpha25.3-beta15.3.15.3.25.3.35.3.45.3.55.3.65.45.4-alpha1 |
5.4.3 |
org.apache.httpcomponents.core5:httpcore5-h2Maven |
5.5-alpha1 up to 5.5-beta2, plus listed versions 5.5-beta1 |
5.5-beta2 |
org.apache.httpcomponents.core5:httpcore5-h2Root:Maven |
before 5.3.5-aikido.1 | 5.3.5-aikido.15.4-aikido.15.3.5-aikido.25.3.4-aikido.15.3.6-aikido.15.1.3-aikido.15.2-aikido.2 |
io.root.org.apache.httpcomponents.core5:httpcore5-h2Root:Maven |
before 5.3.5-root.io.1 | 5.3.5-root.io.15.4-root.io.15.3.5-root.io.25.3.4-root.io.15.3.6-root.io.15.1.3-root.io.15.2-root.io.2 |
httpcomponents-coreUbuntu:14.04:LTS |
All versions, plus listed versions 4.2.4-14.3-14.3.1-14.3.2-14.3.2-2 |
None known |
httpcomponents-coreUbuntu:16.04:LTS |
All versions, plus listed versions 4.4.1-14.4.3-14.4.4-1 |
None known |
httpcomponents-coreUbuntu:18.04:LTS |
All versions, plus listed versions 4.4.7-14.4.8-14.4.9-1 |
None known |
httpcomponents-coreUbuntu:20.04:LTS |
All versions, plus listed versions 4.4.11-14.4.12-14.4.13-1 |
None known |
httpcomponents-coreUbuntu:22.04:LTS |
All versions, plus listed versions 4.4.14-14.4.14-2 |
None known |
httpcomponents-core5Ubuntu:22.04:LTS |
All versions, plus listed versions 5.1.2-15.1.2-25.1.3-1 |
None known |
httpcomponents-coreUbuntu:24.04:LTS |
All versions, plus listed versions 4.4.16-1 |
None known |
httpcomponents-core5Ubuntu:24.04:LTS |
All versions, plus listed versions 5.2.1-15.2.2-1 |
None known |
httpcomponents-coreUbuntu:25.10 |
All versions, plus listed versions 4.4.16-1 |
None known |
httpcomponents-core5Ubuntu:25.10 |
All versions, plus listed versions 5.2.2-1 |
None known |
httpcomponents-coreUbuntu:26.10 |
All versions, plus listed versions 4.4.16-1build1 |
None known |
httpcomponents-core5Ubuntu:26.10 |
All versions, plus listed versions 5.4-15.4.2-1.15.4.3-1 |
None known |
httpcomponents-coreUbuntu:26.04:LTS |
All versions, plus listed versions 4.4.16-14.4.16-1build1 |
None known |
httpcomponents-core5Ubuntu:26.04:LTS |
All versions, plus listed versions 5.2.2-15.2.2-25.4-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| affected | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-54428 is a high vulnerability (CVSS 7.5) in Apache Httpcomponents Core, published July 1, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.87%, the 59th percentile. Fixed in org.apache.httpcomponents.core5:httpcore5-h2 5.4.3.
References
lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd
openwall.com/lists/oss-security/2026/07/01/3
nvd.nist.gov/vuln/detail/CVE-2026-54428
github.com/apache/httpcomponents-core/commit/1ea1239bbbe3442a8382a87279c0a8119a7e358e
Left out here: 2 versions. The JSON record has them.