Denial of Service Vulnerability in Apache HttpComponents Core

CVE-2026-54428

What is CVE-2026-54428?

A vulnerability exists in the HTTP/2 HPACK decoder of Apache HttpComponents Core, specifically in versions 5.4.2 and earlier, including 5.5-beta1. This issue stems from the lack of limits or throttling during the allocation of resources, enabling remote attackers to exploit it by sending oversized compressed header blocks. This can lead to memory exhaustion and ultimately result in a denial of service condition before the HTTP/2 SETTINGS acknowledgement enforces the configured header list size limits.

References