CVE-2026-54399

Published: Jul 1, 2026Modified: Jul 6, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending messages with excessive number of headers / excessive header length

Affected (3)

Products: Apache: Httpcomponents Core

1 product

Httpcomponents Core

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Apache Httpcomponents Core	Up to 5.4.2
Apache Httpcomponents Core	Version 5.5 alpha1
Apache Httpcomponents Core	Version 5.5 beta1

Related CWEs

Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

References (2)

https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy

Source: security@apache.org

Mailing ListVendor Advisory

http://www.openwall.com/lists/oss-security/2026/07/01/4

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

Timeline

No history available yet.